Xiaopi Auto Updater

What to check before installing: - Verify publisher & metadata: the skill bundle lacks a homepage/source and the included _meta.json ownerId/slug differs from the registry metadata — confirm you trust the account that published this skill. - Review the script before enabling: the helper script (~/.clawdbot/scripts/auto-update.sh) is created and will run package manager and clawdhub commands. Open and read it to ensure it does nothing unexpected. - Run a dry-run first: use `clawdhub update --all --dry-run` and test the commands manually before enabling cron to see what would change. - Limit privilege & scope: run the cron under an isolated user/session (the skill already suggests --session isolated) and avoid running global package managers as root unless you understand the implications. - Backup & logging: ensure backups exist and retain the update log (~/.clawdbot/logs/auto-update.log) so you can inspect changes and recover if an update introduces issues. - Consider restricting updates to trusted skills: automatic updates can introduce new code; if you rely on sensitive skills, prefer manual review or whitelist-only updates. Why I flagged this as suspicious rather than benign: the runtime behavior is coherent with the described purpose, but missing source/homepage and inconsistent metadata raise provenance concerns — those should be resolved before you allow automatic updates to run.