Auto-Updater Skill

Automatically update Clawdbot and all installed skills once daily. Runs via cron, checks for updates, applies them, and messages the user with a summary of what changed.

Security Scan

The skill's instructions are consistent with its stated purpose (setting up a daily cron job to update Clawdbot and installed skills); it does not request extra credentials or install arbitrary code itself, but auto-applying updates carries operational risk (trust in the registry and permissions).

Purpose & Capability

The name/description match the instructions: SKILL.md explains creating a cron job that runs clawdbot and clawdhub update commands. The actions (npm/pnpm/bun update, clawdbot update, clawdhub update --all) are proportional to 'auto-update' functionality. Note: the skill assumes clawdbot/clawdhub and package managers exist on the system even though required binaries are not explicitly declared in metadata.

Instruction Scope

Instructions are narrowly focused on updating Clawdbot and skills, creating a helper script under ~/.clawdbot/, logging to ~/.clawdbot/logs/, and adding a cron job. They do not instruct reading unrelated files or exfiltrating data. However, the runtime commands will perform network operations and modify installed software; the guide also suggests using sudo/permission fixes when necessary — so the agent will be able to perform privileged actions if the environment allows them.

Install Mechanism

This is an instruction-only skill with no install spec and no code files — minimal installer risk. It writes a helper script and cron job at runtime (user home), which is expected for this functionality.

Credentials

No environment variables or credentials are requested, which is appropriate. Important security consideration: the skill automatically trusts whatever the registry/ClawdHub provides when running 'clawdhub update --all' and will apply updates without interactive review unless the user configures otherwise. Automatic updates increase the attack surface if the registry, ClawdHub, or package update channels are compromised.

Persistence & Privilege

The skill does not force permanent inclusion (always:false) and is user-invocable, but it does create a cron job and helper script that persist and run daily under the user's account. That persistence is expected for an auto-updater but does increase blast radius relative to a one-off manual command — ensure the cron job runs with least privilege and not as root.

Assessment

This skill is internally coherent and does what it says: it will create a script and add a daily cron job that runs 'clawdbot' and 'clawdhub' update commands and then message you a summary. Before installing, consider: 1) Auto-updates implicitly trust the registry and update channels — if the registry or an updated package is malicious you could auto-install it; consider using dry-run ('clawdhub update --all --dry-run') or limiting updates to specific skills. 2) Global package updates (npm/pnpm/bun) may require elevated permissions; avoid running the cron job as root. 3) The script/logs are placed in ~/.clawdbot/ — review and backup before enabling. 4) Confirm clawdbot and clawdhub are present and working locally. 5) If you want tighter control, run updates manually or weekly, or configure the cron job to notify you for manual approval. If you want me to propose a safer variant (e.g., dry-run + email/notification for approvals, or limited-scope updates), I can produce the modified SKILL.md and cron commands.

Keep your Clawdbot and skills up to date automatically with daily update checks.

What It Does

This skill sets up a daily cron job that:

1. Updates Clawdbot itself (via clawdbot doctor or package manager)
2. Updates all installed skills (via clawdhub update --all)
3. Messages you with a summary of what was updated

Setup

Quick Start

Ask Clawdbot to set up the auto-updater:

Set up daily auto-updates for yourself and all your skills.

Or manually add the cron job:

clawdbot cron add \
  --name "Daily Auto-Update" \
  --cron "0 4 * * *" \
  --tz "America/Los_Angeles" \
  --session isolated \
  --wake now \
  --deliver \
  --message "Run daily auto-updates: check for Clawdbot updates and update all skills. Report what was updated."

Configuration Options

Option	Default	Description
Time	4:00 AM	When to run updates (use --cron to change)
Timezone	System default	Set with --tz
Delivery	Main session	Where to send the update summary

How Updates Work

Clawdbot Updates

For npm/pnpm/bun installs:

npm update -g clawdbot@latest
# or: pnpm update -g clawdbot@latest
# or: bun update -g clawdbot@latest

For source installs (git checkout):

clawdbot update

Always run clawdbot doctor after updating to apply migrations.

Skill Updates

clawdhub update --all

This checks all installed skills against the registry and updates any with new versions available.

Update Summary Format

After updates complete, you'll receive a message like:

🔄 Daily Auto-Update Complete

**Clawdbot**: Updated to v2026.1.10 (was v2026.1.9)

**Skills Updated (3)**:
- prd: 2.0.3 → 2.0.4
- browser: 1.2.0 → 1.2.1  
- nano-banana-pro: 3.1.0 → 3.1.2

**Skills Already Current (5)**:
gemini, sag, things-mac, himalaya, peekaboo

No issues encountered.

Manual Commands

Check for updates without applying:

clawdhub update --all --dry-run

View current skill versions:

clawdhub list

Check Clawdbot version:

clawdbot --version

Troubleshooting

Updates Not Running

1. Verify cron is enabled: check cron.enabled in config
2. Confirm Gateway is running continuously
3. Check cron job exists: clawdbot cron list

Update Failures

If an update fails, the summary will include the error. Common fixes:

• Permission errors: Ensure the Gateway user can write to skill directories
• Network errors: Check internet connectivity
• Package conflicts: Run clawdbot doctor to diagnose

Disabling Auto-Updates

Remove the cron job:

clawdbot cron remove "Daily Auto-Update"

Or disable temporarily in config:

{
  "cron": {
    "enabled": false
  }
}

Resources

• Clawdbot Updating Guide
• ClawdHub CLI
• Cron Jobs