Evomasterscheduler

Automates daily health checks, fixes, memory cleanup, backups, improvements, upgrades, and security audits for the OpenClaw environment.

Security Scan

The skill broadly matches a maintenance scheduler but contains several mismatches and risky behaviors (reading and copying sensitive files, writing into other skill paths, calling missing external scripts/commands) that are not justified or declared.

Purpose & Capability

The name/description (daily health, backups, fixes, upgrades, security) aligns with the included scripts. Using the openclaw CLI to create crons, run gateway commands, and perform audits is consistent with an OpenClaw maintenance tool. However, the scripts also touch resources outside the described narrow scope (e.g., ~/Obsidian/OpenClaw/scripts/checkpoint-vault.sh and a separate skill's .learnings file), which is broader than a simple scheduler and not justified in the SKILL.md.

Instruction Scope

Scripts read and copy sensitive files (~/.openclaw/.env, ~/.openclaw/openclaw.json), create git commits of workspace content, call external scripts that are not included (redis-memory-bridge.py, slack-notify.sh, checkpoint-vault.sh), and write into another skill's directory (~/.openclaw/workspace/skills/xiucheng-self-improving-agent/.learnings). They also invoke external tools (ollama, python3, git) and restart services (openclaw gateway start). The SKILL.md does not document these dependencies or the sensitive reads/writes.

Install Mechanism

This is an instruction-only skill (no remote downloads or installers). All files are present in the skill bundle; there is no external install URL or archive extract. That reduces supply-chain risk relative to a remote download installer.

Credentials

The skill declares no required environment variables or credentials, yet its scripts access potentially sensitive configuration and credential files (~/.openclaw/.env, agents config) and copy them into backups and git. It also uses Slack notification helpers and openclaw/ollama/redis utilities that likely depend on credentials or tokens. Not declaring or justifying access to secrets and not listing required tools is a proportionality mismatch.

Persistence & Privilege

The consolidate-crontab.sh will add persistent scheduled jobs to the OpenClaw cron system (openclaw cron add) and the scripts perform recurring tasks (including a 5-minute Redis checkpoint). The skill does not set always:true, but it does create persistent crons and can restart the gateway, so installing/running it gives it ongoing system influence. This persistence is expected for a scheduler but increases blast radius because the scripts operate on sensitive files and other skill directories.

What to consider before installing

Before installing or running this skill: - Inspect the missing helper scripts it calls (bash "$HOME/.openclaw/scripts/slack-notify.sh", redis-memory-bridge.py, and checkpoint-vault.sh). Understand what credentials or tokens those helpers use. - Be aware it copies ~/.openclaw/.env and openclaw.json into backups and runs git commits of workspace content — that can expose secrets. If you keep secrets in .env, remove or redact them before allowing automatic backups or modify the script not to copy .env. - Note the skill writes into another skill's directory (~/.openclaw/workspace/skills/xiucheng-self-improving-agent/.learnings). Confirm you want cross-skill writes and the receiving skill's behavior. - Confirm you have the required binaries (openclaw, git, python3, ollama) on the host and that automatic restart (openclaw gateway start) is acceptable. - Run the consolidation script in a controlled environment (staging) and review the crons it will create (openclaw cron list). Consider running the crons manually first rather than enabling scheduled runs. - If you proceed, restrict permissions on backups and logs, or modify scripts to avoid storing secrets in plaintext or committing backups to git. Given the number of undeclared dependencies and sensitive file operations, treat this skill as suspicious until you verify and sanitize the external helper scripts and the backup behavior.

EvoMasterScheduler Skill

The EvoMasterScheduler is a self-evolving system of daily maintenance tasks designed to ensure the health, security, and continuous improvement of the OpenClaw environment.

Daily Schedule

Time	Script	Purpose
03:00	cron-diagnose.sh	System health check and error detection
03:00	cron-fix.sh	Automated remediation of detected issues
03:00	cron-memory.sh	Memory optimization and debris cleanup
03:05	cron-backup.sh	Critical configuration and state backup
03:10	cron-improve.sh	Analysis of logs to suggest/apply improvements
03:15	cron-upgrade.sh	Check for and apply stable component updates
03:20	cron-security.sh	Security audit and permission validation

Logging

All scripts log to ~/.openclaw/logs/evomaster-$(date +%Y-%m-%d).log.

Installation

Run consolidate-crontab.sh to synchronize these tasks with the system crontab.