OpenClaw Self-Update

Update OpenClaw to the latest version. Use when asked to "update yourself", "upgrade openclaw", "check for updates", or "update to latest version". Handles n...

This updater appears to do only what it says: check npm, install the latest openclaw package, and restart the gateway. Before running it, verify you trust the npm 'openclaw' package owner and consider running on a test system first. Make sure Node.js/npm and the openclaw CLI are installed and in PATH (the metadata doesn't list these prerequisites). Global npm installs may require sudo and will modify system-wide packages; expect short gateway downtime while restarting. If you need stronger guarantees, inspect the package's npm page, its release notes/CHANGELOG, and verify package integrity (signatures/checksums) before performing the update on production systems.

Type: OpenClaw Skill Name: openclaw-self-update Version: 1.0.0 The skill is classified as suspicious due to its use of high-privilege commands and inherent supply chain risks. The `SKILL.md` and `scripts/update.sh` files instruct the agent to execute `npm install -g openclaw@latest`, which can run arbitrary code via `package.json` scripts from the installed package. Additionally, `SKILL.md` suggests using `sudo npm install -g openclaw@latest` for permission issues, indicating a privilege escalation capability. While these actions are aligned with the stated purpose of updating the OpenClaw agent, they represent significant risky capabilities that could be exploited in a supply chain attack or if the agent is compromised.