Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Auto Updater Gateway
v1.0.0Automate daily ClawHub skill updates at 04:00 with version comparison and update reports sent to Feishu or Telegram via OpenClaw Gateway Cron.
⭐ 0· 45·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description, README, and SKILL.md all describe scheduling daily ClawHub skill updates and sending reports; the required actions (openclaw cron add, npx clawhub list/update) are coherent with that purpose. Minor mismatch: the skill declares no required env vars/credentials even though the workflow implicitly requires a logged-in ClawHub session and configured delivery channels (Feishu/Telegram).
Instruction Scope
SKILL.md only instructs running gateway cron commands and clawhub CLI commands (list, update, whoami, login) and producing/sending a report. It does not instruct reading unrelated system files or exfiltrating data to unknown endpoints. The scope is limited to scheduling, running updates, comparing versions, and delivering a report.
Install Mechanism
This is an instruction-only skill with no install spec and no code files to execute. package.json and README are present but no runtime install steps are requested by the registry metadata—lowest install risk.
Credentials
The skill requests no environment variables, but its workflow requires ClawHub authentication (npx clawhub login / whoami) and configured delivery credentials for Feishu/Telegram via the Gateway. Those credentials are not declared, which is an omission: users must ensure appropriate tokens/sessions exist and understand the privilege being granted (the job will run updates that can install/replace skills).
Persistence & Privilege
always is false and agent autonomous invocation is allowed (default). That is normal, but because the job runs `npx clawhub update --all` it can modify other installed skills automatically—this widens blast radius if updates introduce changes. No evidence the skill attempts to persist beyond its cron job or modify other skills' configs directly.
What to consider before installing
This skill does what it says (schedule daily ClawHub updates and send a report), but before installing you should: 1) confirm how ClawHub authentication is provided (the cron job will need a logged-in session or tokens) and limit that account's privileges; 2) verify Feishu/Telegram delivery configuration and tokens are scoped appropriately; 3) be aware that `npx clawhub update --all` will automatically install updates for other skills (which can change behavior or introduce new code), so consider testing with `openclaw cron run` manually first and/or pinning critical skills or using selective updates rather than `--all`; 4) review update logs and enable notifications for any unexpected changes; 5) if you need stricter control, avoid autonomous scheduling or require a manual approval step for updates.Like a lobster shell, security has layers — review code before you run it.
latestvk97d26h1rn38qmjt3ehz0278bh83ge57
License
MIT-0
Free to use, modify, and redistribute. No attribution required.