OpenClaw Guardian by MyClaw.ai

Deploy and manage a Guardian watchdog for OpenClaw Gateway. Auto-monitor every 30s, self-repair via doctor --fix, git-based workspace rollback, daily snapsho...

Security Scan

The skill's code and instructions are consistent with its stated purpose (a watchdog that runs doctor --fix, does git rollbacks, daily snapshots, and optional Discord alerts), but there are a few small mismatches and operational risks you should review before installing.

Purpose & Capability

Name/description, SKILL.md, and scripts/guardian.sh align: the script monitors an OpenClaw Gateway, runs openclaw doctor --fix, attempts git rollback, restarts the gateway, and optionally posts to a Discord webhook. The required tooling (git, pgrep/pgrep+pkill, curl) and use of the OpenClaw CLI are coherent with the stated purpose.

Instruction Scope

Instructions and script perform actions that are expected for a watchdog: periodic health checks, invoking openclaw doctor --fix, performing git reset --hard to a stable commit, creating daily git commits, restarting gateway process, and writing logs to /tmp. These actions will modify files in the specified workspace (git commits, hard resets) and restart processes — not out-of-scope but potentially destructive if the workspace contains uncommitted or sensitive data. The SKILL.md and script do not attempt to read unrelated system config or exfiltrate data beyond the optional Discord webhook.

Install Mechanism

This is an instruction-only skill with a bundled script; there is no download/install from external URLs and nothing is written to disk by an installer. Risk from installation is low — the main risk is running the provided script itself.

Credentials

The skill declares DISCORD_WEBHOOK_URL as the primary credential but treats it as optional in documentation and code (only used if set). Registry/metadata lists required binaries as git, pgrep, curl but the script also expects pkill, nohup and the openclaw CLI; openclaw is referenced in SKILL.md but not listed in the registry required-binaries. These mismatches are likely harmless but should be clarified. Also note the script will auto-commit all workspace changes (daily_backup) and performs git reset --hard (data loss risk) — environmental access to the workspace is inherent to function and should be evaluated before use.

Persistence & Privilege

The skill does not request forced always-on privilege. It instructs the user how to run the script as a background process and how to add it to a startup helper; these are normal for a watchdog. The script only modifies its own workspace and /tmp files, and restarts the gateway process (expected for this role).

Assessment

This skill generally does what it says, but review and test before deploying to production: - Backup your workspace first. The guardian runs git reset --hard and will discard uncommitted changes; it also auto-commits all changes daily. Ensure the repo contains only content you are willing to have committed and potentially rolled back. - Confirm availability of required binaries: git, pgrep, pkill, curl, nohup, and especially the OpenClaw CLI (openclaw). The registry metadata omitted pkill and openclaw; ensure they exist. - Review what openclaw doctor --fix and openclaw gateway do in your environment — these commands can perform wide-reaching repairs/restarts. - Discord webhook: the webhook is optional, but the registry marks it as the primary credential; verify the webhook URL destination and treat it as a secret. Notifications contain only brief status messages, but do not supply other workspace contents by default. - Run the script in a sandbox or staging environment first to confirm behavior and to tune intervals/cooldowns/repair attempts. - If you need stricter safety, consider modifying the script to: (a) require manual approval before git reset --hard, (b) restrict auto-commit behavior or exclude certain files, and (c) log (and rotate) backups outside the workspace. Given the above, the skill appears coherent with its purpose but requires operational caution.

OpenClaw Guardian

A standalone watchdog that keeps your OpenClaw Gateway alive 24/7. Built from MyClaw.ai's production infrastructure and open-sourced for the community.

Powered by MyClaw.ai — https://myclaw.ai

What It Does

• Checks Gateway health every 30 seconds (GUARDIAN_CHECK_INTERVAL, default: 30)
• On failure: runs openclaw doctor --fix up to 3 times (GUARDIAN_MAX_REPAIR, default: 3)
• If still down: git reset --hard to last stable commit, restart Gateway
• Daily automatic git commit snapshot of workspace
• Optional Discord webhook alerts (DISCORD_WEBHOOK_URL)

Environment Variables

All optional — defaults work out of the box:

Variable	Default	Description
GUARDIAN_WORKSPACE	$HOME/.openclaw/workspace	Workspace path (must be a git repo)
GUARDIAN_LOG	/tmp/openclaw-guardian.log	Log file path
GUARDIAN_CHECK_INTERVAL	30	Health check interval (seconds)
GUARDIAN_MAX_REPAIR	3	Max doctor --fix attempts before rollback
GUARDIAN_COOLDOWN	300	Cooldown period after all repairs fail (seconds)
OPENCLAW_CMD	openclaw	OpenClaw CLI command
DISCORD_WEBHOOK_URL	(unset)	Discord webhook URL for alerts (optional)

Required System Tools

• git — for workspace rollback and daily snapshots
• pgrep / pkill — for process detection
• curl — for Discord webhook alerts (only if DISCORD_WEBHOOK_URL is set)
• openclaw — the OpenClaw CLI

Quick Start

Tell your OpenClaw agent:

"Help me install openclaw-guardian to harden my gateway"

Or manually:

# 1. Init git in workspace (required for rollback)
cd ~/.openclaw/workspace
git init && git add -A && git commit -m "initial"

# 2. Install
cp scripts/guardian.sh ~/.openclaw/guardian.sh
chmod +x ~/.openclaw/guardian.sh

# 3. Start
nohup ~/.openclaw/guardian.sh >> /tmp/openclaw-guardian.log 2>&1 &

Note: Use repository-level git config, not --global:

git -C ~/.openclaw/workspace config user.email "[e-mail]"
git -C ~/.openclaw/workspace config user.name "Guardian"

Auto-start on Container Restart

Add to ~/.openclaw/start-gateway.sh before the final exec line:

pkill -f "guardian.sh" 2>/dev/null || true
nohup /home/ubuntu/.openclaw/guardian.sh >> /tmp/openclaw-guardian.log 2>&1 &

Full docs: https://github.com/LeoYeAI/openclaw-guardian