Smart Auto Updater

What to consider before installing/using: - Trust & provenance: The skill has no source/homepage and no code files — treat it like opaque instructions. Prefer skills with a verifiable repository and maintainer. - Config & secrets: The docs reference many environment variables and webhook URLs (feishu/slack/discord) but the metadata declares none. Before enabling, ensure you control any webhook endpoints the skill will use and avoid putting sensitive credentials into untrusted agents. - Persistence: The skill can create cron jobs and auto-apply updates (including OpenClaw/core skills). If you enable auto-update, start with conservative settings (AUTO_UPDATE=NONE or LOW risk tolerance) and run in dry-run mode first. - Least privilege testing: Run the skill in an isolated or staging environment first. Inspect any created files (~/.config/smart-auto-updater.env, ~/.logs/smart-auto-updater.log) and review scheduled crons (openclaw cron list or system cron) before allowing it to run in production. - Auditability: Because the skill will fetch changelogs and may send reports externally, ensure logs and report destinations are monitored for unexpected content or destinations. Things that would change this assessment: presence of a public source repo or installable package that shows exact commands run, explicit declaration of required env vars/credentials in the metadata, or code files showing no unexpected network/file operations. Without that, the metadata/instructions mismatch (config files and webhooks referenced but not declared) makes the package suspicious.