Guardian — OpenClaw 7x24 Watchdog & Auto-Healer

ReviewAudited by ClawScan on May 10, 2026.

Overview

This watchdog is mostly purpose-aligned, but it deserves review because it installs a persistent agent job that can restart OpenClaw automatically and has some overbroad or inconsistent implementation details.

Install only if you intentionally want a persistent watchdog that can restart OpenClaw without asking each time. Before scheduling it, review the Python script, fix or confirm the log path, ensure the memory check targets only OpenClaw processes, and know how to disable or remove the cron job.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

OpenClaw could be restarted repeatedly or during active work because another Node application is using memory.

Why it was flagged

On Windows the memory check totals every node.exe process, then automatically restarts the OpenClaw gateway when the total crosses the kill threshold. That is broader than the stated OpenClaw-specific memory check and can trigger a high-impact action from unrelated processes.

Skill content
run(["tasklist", "/FI", "IMAGENAME eq node.exe", "/FO", "CSV", "/NH"], timeout=10) ... if mem["memory_mb"] > MEM_KILL_MB: ... restart_gateway(cli)
Recommendation

Scope memory checks to the actual OpenClaw gateway PID/process, make restart alert-only by default or require explicit user approval, and let users tune thresholds.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

The watchdog will continue running and may restart the gateway until the cron job is disabled or removed.

Why it was flagged

The skill creates a recurring autonomous agent job every five minutes. This is disclosed and aligned with a watchdog, but it is persistent behavior that keeps operating after setup.

Skill content
Runs as a cron job — zero manual intervention after setup ... "everyMs": 300000 ... "kind": "agentTurn"
Recommendation

Install it only if you want continuous monitoring, verify the cron job with `openclaw cron list`, and use the documented disable/remove commands when no longer needed.

What this means

Users may not find the logs where the documentation says they should be, making it harder to audit what the watchdog did.

Why it was flagged

SKILL.md tells users logs are written to `~/.openclaw/logs/guardian.log`, but the script writes to a `.qclaw`-style path. This mismatch can mislead users during verification or troubleshooting.

Skill content
LOG_DIR = os.path.expandvars(r"%USERPROFILE%\.qclaw\logs")
Recommendation

Align the code with the documented OpenClaw log path or clearly document the actual path for each operating system.

What this means

Users need to manually verify the script and ensure the needed local tools are available before scheduling it.

Why it was flagged

The visible source does not show remote downloads, but the registry metadata provides no provenance and does not declare the local runtime/CLI requirements that the instructions rely on.

Skill content
Source: unknown; Homepage: none ... Required binaries (all must exist): none ... No install spec — this is an instruction-only skill.
Recommendation

Inspect the included script, confirm `python3` and the `openclaw` CLI are available, and prefer a version with declared requirements and provenance.