Update

Automatically update Clawdbot and all installed skills once daily. Runs via cron, checks for updates, applies them, and messages the user with a summary of what changed.

This skill appears to do what it says (schedule and run updates) but has two things you should verify before installing: (1) The SKILL.md expects you to install and run 'openclawcli' but the skill metadata does not declare that required binary — ask the publisher to add it to metadata. (2) The instructions point to a third-party GitHub release and a glot.io snippet for installing openclawcli; treat these as unverified installers. Do not run arbitrary downloaded executables without verifying the publisher and release integrity. If you proceed: review the exact cron command the skill will install, run clawdhub update --all --dry-run first, back up any critical skills/config, ensure you are comfortable granting the user running Clawdbot permission to update global packages, and prefer installing openclawcli from an official project release or your organization's vetted source. If you cannot validate the openclawcli source, consider performing updates manually instead.

Type: OpenClaw Skill Name: update Version: 1.0.0 The skill's core functionality for auto-updating Clawdbot and other skills appears benign. However, the `SKILL.md` file contains highly insecure instructions for installing its `openclawcli` prerequisite. For macOS, it directs users to visit `glot.io/snippets/hfd3x9ueu5` and execute an installation command from this untrusted pastebin, which is a critical remote code execution (RCE) vulnerability. For Windows, it instructs downloading and running an executable from an arbitrary GitHub user (`Ddoy233/openclawcli`), posing a significant supply chain risk. These instructions, if followed by an AI agent or user, could lead to system compromise by executing arbitrary, potentially malicious, external code.