Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

OpenClaw Upgrade Fix

v1.0.0

安全升级OpenClaw 2026.4.x,自动备份配置,排查修复升级问题,管理权限并支持版本回滚。

0· 44·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for yoyoyosan/alice-upgrade-fix.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "OpenClaw Upgrade Fix" (yoyoyosan/alice-upgrade-fix) from ClawHub.
Skill page: https://clawhub.ai/yoyoyosan/alice-upgrade-fix
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install alice-upgrade-fix

ClawHub CLI

Package manager switcher

npx clawhub@latest install alice-upgrade-fix
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description claim an upgrade-and-fix utility for OpenClaw 2026.4.x; the included scripts back up ~/.openclaw files, run an npm upgrade, restart the Gateway, clean plugin dirs, and validate/repair config — all consistent with that purpose. The SKILL.md references related skills/scripts not present in this package (e.g., smart-backup.sh/openclaw-recovery), which is a minor inconsistency but not critical.
Instruction Scope
Runtime instructions and the three scripts operate on the user's home OpenClaw data (~/.openclaw), read/write JSON configs, restart services, and delete plugin directories. These actions are within the upgrade/repair scope, but the scripts also unconditionally set 'tools.profile' to 'full' and copy auth-profiles.json to backups. The SKILL.md and scripts assume control over agent permissions and sensitive files — this is powerful and requires explicit user review before execution.
Install Mechanism
There is no install spec in the registry, but the upgrade script performs a runtime network install via 'npm i -g openclaw@latest'. Using npm to fetch the updated product is expected for an upgrade script, however it downloads and executes code from the public npm registry at runtime, which is a non-trivial security action and should be performed only when the package origin and version are trusted.
!
Credentials
The skill declares no environment variables, but it reads and writes sensitive local config files (openclaw.json, auth-profiles.json, various workspace files). Backing up auth-profiles.json may copy authentication material to backups; the script does not encrypt or otherwise protect these backups. Most notably, the scripts force tools.profile='full' — an elevation that broadens allowed tool capabilities (exec/gateway/browser/etc.). That change is disproportionate unless the user explicitly wants to grant full tooling privileges.
!
Persistence & Privilege
The skill does not set always:true and does not modify other skills, but it persistently modifies the OpenClaw configuration to set tools.profile='full', which effectively grants broader privileges to agents/tools going forward. This permanent configuration change is a high-impact side effect and should be explicitly acknowledged and approved by the administrator before running.
What to consider before installing
This skill appears to be a legitimate OpenClaw upgrade/fix tool, but it performs several sensitive actions automatically. Before installing or running it: 1) Inspect ~/.openclaw/openclaw.json and auth-profiles.json to understand what will be changed and what secrets may be backed up. 2) Review and, if necessary, remove or modify the code that sets tools.profile='full' — granting 'full' tooling permissions can enable remote code execution or broader agent capabilities. 3) Verify that backing up auth-profiles.json to ~/.openclaw/backups is acceptable (consider encrypting or restricting backup permissions). 4) Confirm you trust the npm package origin before running 'npm i -g openclaw@latest' (perform offline review or pin a known good version). 5) Run the scripts first in a staging/test environment and review logs before applying to production. 6) Note the SKILL.md references smart-backup.sh/openclaw-recovery which are not included — ensure your backup automation is present. If you are uncomfortable with automatic permission elevation or backing up sensitive auth files, do not run these scripts until they are audited/modified.

Like a lobster shell, security has layers — review code before you run it.

fixvk97as6qtrfrwfzv6171ccxrwb585jbp1latestvk97as6qtrfrwfzv6171ccxrwb585jbp1permissionsvk97as6qtrfrwfzv6171ccxrwb585jbp1upgradevk97as6qtrfrwfzv6171ccxrwb585jbp1
44downloads
0stars
1versions
Updated 2d ago
v1.0.0
MIT-0

OpenClaw 升级与维护 Skill

版本:1.0 | 更新于:2026-04-27

适用于 OpenClaw 2026.4.x

安全升级 OpenClaw、排查常见问题、管理配置和权限。

功能

  • 一键升级:备份 + 升级 + 验证
  • 升级排错:自动检测和修复常见问题
  • 权限管理:检查和恢复 tools.profile
  • 插件修复:清理插件目录冲突
  • 版本回滚:从备份恢复

快速操作

# 检查当前版本
openclaw --version

# 一键升级(推荐)
bash ~/.openclaw/workspace/skills/openclaw-upgrade/scripts/upgrade.sh

# 升级后排错
bash ~/.openclaw/workspace/skills/openclaw-upgrade/scripts/post-upgrade-fix.sh

# 检查权限
bash ~/.openclaw/workspace/skills/openclaw-upgrade/scripts/check-permissions.sh

升级流程

┌─────────────────────────────────────┐
│  1. 备份配置                         │
│     • openclaw.json                 │
│     • auth-profiles.json            │
│     • MEMORY.md + SOUL.md           │
├─────────────────────────────────────┤
│  2. 执行升级                         │
│     • npm i -g openclaw@latest      │
│     • 等待 Gateway 重启              │
├─────────────────────────────────────┤
│  3. 验证                             │
│     • 版本检查                       │
│     • 权限检查 (tools.profile=full)  │
│     • 插件状态                       │
│     • 健康检查                       │
└─────────────────────────────────────┘

升级后常见问题

问题1:插件目录冲突 (ENOTEMPTY)

症状:

Error: ENOTEMPTY, Directory not empty: .../plugin-sdk

修复:

# 清理旧的插件运行时目录
rm -rf ~/.openclaw/plugin-runtime-deps/openclaw-unknown-*
rm -rf ~/.openclaw/plugin-runtime-deps/openclaw-2026.4.*
openclaw gateway restart

问题2:tools.profile 被重置

症状:

  • exec 权限失效
  • openclaw doctor 后无法执行命令

修复:

# 检查当前值
python3 -c "import json; print(json.load(open('$HOME/.openclaw/openclaw.json')).get('tools',{}).get('profile'))"

# 修复
python3 -c "
import json
c = json.load(open('$HOME/.openclaw/openclaw.json'))
c['tools']['profile'] = 'full'
json.dump(c, open('$HOME/.openclaw/openclaw.json','w'), indent=2)
"
openclaw gateway restart

问题3:Bonjour/mDNS 卡住

症状:

Unhandled promise rejection: CIAO PROBING CANCELLED

修复:

  • 通常是启动时的临时警告
  • 重启后会自动恢复
  • 不影响核心功能

问题4:Gateway 无法启动

修复步骤:

# 1. 检查日志
tail -50 ~/.openclaw/logs/gateway.err.log

# 2. 验证配置
python3 -c "import json; json.load(open('$HOME/.openclaw/openclaw.json'))"

# 3. 从备份恢复
cp ~/.openclaw/backups/openclaw.json.bak.LATEST ~/.openclaw/openclaw.json
openclaw gateway restart

权限配置

正确配置

{
  "tools": {
    "profile": "full"
  }
}

飞书端配置(webchat 频道)

{
  "agents": {
    "list": [{
      "id": "main",
      "tools": {
        "alsoAllow": ["exec", "gateway", "browser", "..."]
      }
    }]
  }
}

注意事项

⚠️ openclaw doctor 可能会重置 tools.profilemessaging

升级后务必检查:

bash ~/.openclaw/workspace/skills/openclaw-upgrade/scripts/check-permissions.sh

备份管理

备份位置

  • 配置备份:~/.openclaw/backups/
  • 记忆备份:~/爱丽丝备份/

自动备份

  • 升级前自动备份
  • 每日 2:00 自动备份(smart-backup.sh)
  • 每周日 3:00 备份 alice 记忆

手动备份

# 完整备份
bash ~/.openclaw/workspace/skills/openclaw-recovery/scripts/smart-backup.sh

# 仅备份配置
cp ~/.openclaw/openclaw.json ~/.openclaw/backups/openclaw.json.bak.$(date +%Y%m%d_%H%M%S)

版本回滚

# 查看可用备份
ls -lt ~/.openclaw/backups/openclaw.json.bak.*

# 从备份恢复
cp ~/.openclaw/backups/openclaw.json.bak.YYYYMMDD_HHMMSS ~/.openclaw/openclaw.json
openclaw gateway restart

相关文件

文件用途
scripts/upgrade.sh一键升级脚本
scripts/post-upgrade-fix.sh升级后排错
scripts/check-permissions.sh权限检查

相关 Skill

Comments

Loading comments...