ClawHub Auto Update

自动检查并更新ClawHub已安装技能。有更新时通知用户，支持手动和定时运行。

Security Scan

This skill's files and instructions are internally consistent with its stated purpose of checking for and running ClawHub updates; it mainly runs npx clawhub update --all and logs results.

Purpose & Capability

Name/description match the actual behavior: the SKILL.md and included script perform update checks and call `npx clawhub update --all`. No unrelated credentials, binaries, or paths are requested.

Instruction Scope

Runtime instructions only run the provided script or call `npx clawhub update --all`. They ask the user to log in with `npx clawhub login` and advise backups because updates overwrite local changes. The instructions do not request unrelated files, credentials, or external endpoints.

Install Mechanism

No install spec (instruction-only) and a small shell script are included. The script uses `npx`, which will fetch and execute packages from npm at runtime — expected for a tool that invokes `clawhub` but worth noting because `npx` executes remote code.

Credentials

The skill declares no environment variables or credentials. It does require the user to be logged into ClawHub (via `npx clawhub login`), which is proportionate to performing updates.

Persistence & Privilege

always:false (not forced). The platform default allows autonomous invocation; if the agent is permitted to call this skill automatically, it can run updates (which overwrite local skill files) without explicit human review. That is functionally powerful but coherent with the skill's purpose — consider whether you want autonomous updates enabled.

Assessment

This skill appears to do exactly what it says: run `npx clawhub update --all` and log output. Before installing, consider: (1) automatic updates will overwrite local modifications — back up any custom skill code; (2) `npx` may fetch and run packages from the npm registry at runtime, so ensure you trust the clawhub package and your npm configuration; (3) if you allow autonomous invocation (agent can call skills), the agent could trigger updates without your explicit approval — if you prefer manual control, run the script yourself or keep cron/manual usage; (4) verify that the log path (~/.openclaw/logs) is acceptable and writable. Overall the skill is coherent and proportionate, but treat automatic updates with the usual caution.

自动检查并更新已安装的ClawHub技能。

功能

1. 检查更新：对比本地版本与ClawHub最新版本
2. 批量更新：自动更新所有可更新的技能
3. 通知用户：有更新时推送通知
4. 定时运行：支持cron定时检查

实际使用

方式1：运行脚本自动检查+更新

bash ~/.openclaw/workspace/skills/clawhub-auto-update/scripts/check-update.sh

方式2：定时运行（推荐）

添加到crontab：

# 每周日凌晨3点检查更新
0 3 * * 0 bash ~/.openclaw/workspace/skills/clawhub-auto-update/scripts/check-update.sh >> ~/.openclaw/logs/skill-update.log 2>&1

方式3：手动更新

npx clawhub update --all

输出格式

更新时输出：

🔄 检查技能更新...
✅ skill-name: 1.0.0 → 1.1.0 已更新
📊 共检查 X 个技能，Y 个可更新

集成到主流程

在 auto-learn.sh 中添加：

# 每周日检查技能更新
if [ "$(date +%w)" = "0" ]; then
  echo "🔄 检查技能更新..."
  npx clawhub update --all >> ~/.openclaw/logs/skill-update.log 2>&1
fi

注意事项

• 需要先登录ClawHub：npx clawhub login
• 更新会覆盖本地修改（如果有）
• 建议先备份重要配置