ClawDoctor

Self-healing doctor for OpenClaw. Monitors gateway, crons, sessions, auth, and costs. Sends Telegram alerts. Auto-restarts gateway when it goes down. Use whe...

This skill appears to do what it claims (monitor OpenClaw and restart the gateway), but there are red flags you should address before installing: 1) Verify the npm package source and repository (review the package code, maintainer, and release history). Do not install a global npm package you can't audit. 2) Confirm the presence and trustworthiness of the 'openclaw' binary on the host; the registry metadata should have declared it. 3) Run clawdoctor in dry-run mode first (clawdoctor start --dry-run) and review its logs/events before enabling auto-heal. 4) When configuring Telegram, restrict the bot permissions and avoid placing tokens in world-readable files; prefer per-service tokens and secrets management. 5) If possible, run the tool under a limited user account or inside a container to reduce blast radius of an arbitrary npm package. Additional information that would raise confidence: a visible package repository or homepage with source code, verifiable package maintainers, and explicit declared requirements (openclaw binary and required env vars) in the registry metadata.

Type: OpenClaw Skill Name: relayplane-clawdoctor Version: 0.4.11 The skill bundle describes a 'self-healing' utility that requires high-risk permissions, including reading sensitive session logs (~/.openclaw/agents/*/sessions/*.jsonl) which may contain PII or secrets, installing persistence via systemd services, and executing system commands. While these actions align with the stated purpose of monitoring and recovery, the broad access to user data and the reliance on an external npm package (clawdoctor) without source visibility pose a significant security risk. The documentation also includes external links to Stripe for paid tiers and a dedicated domain (clawdoctor.dev).