Security checks across malware telemetry and agentic risk
Ghostclaw mostly fits an architecture-review tool, but it also includes self-updating and broad background automation that can modify local installs and GitHub state without strong safeguards.
Review this skill carefully before installing. Use it only on repositories you intend it to read, avoid --update, keep hook or cron modes disabled unless you explicitly want background scans, run watcher mode with --dry-run first, and do not enable --create-pr or provide GitHub tokens unless they are least-privilege and limited to the intended repositories.
# Fallback to pip update
try:
print("Updating via pip...")
subprocess.run([sys.executable, "-m", "pip", "install", "--upgrade", "ghostclaw"], check=True)
print("✅ Updated via pip.")
except subprocess.CalledProcessError as e:
print(f"❌ Failed to update via pip: {e}", file=sys.stderr)if is_git:
print(f"Detected git repository at {package_root}. Pulling latest changes...")
subprocess.run(["git", "pull"], cwd=package_root, check=True)
print("✅ Updated via git.")
# Also run pip install . to ensure dependencies are updated if pyproject.toml changed
subprocess.run([sys.executable, "-m", "pip", "install", "-e", "."], cwd=package_root, check=True)subprocess.run(["git", "pull"], cwd=package_root, check=True)
print("✅ Updated via git.")
# Also run pip install . to ensure dependencies are updated if pyproject.toml changed
subprocess.run([sys.executable, "-m", "pip", "install", "-e", "."], cwd=package_root, check=True)
return
except Exception as e:66/66 vendors flagged this skill as clean.