Auto Updater.Bak2

Automatically update Clawdbot and all installed skills once daily. Runs via cron, checks for updates, applies them, and messages the user with a summary of w...

Security Scan

The skill's instructions and requirements are consistent with its stated purpose (scheduling and running daily updates for Clawdbot and installed skills); it is instruction-only and does not request unrelated credentials or installs, but updating all installed skills and writing logs are powerful actions the user should review and control.

Purpose & Capability

Name/description match the instructions: the SKILL.md and reference docs only describe adding a cron job that runs clawdbot update/doctor and clawdhub update --all. No unrelated services, binaries, or credentials are requested.

Instruction Scope

Instructions stay within the updater scope (detect install type, run package manager updates, run clawdhub update --all, write a log, and emit a parsable summary). Notable behaviors: creates a helper script under the user's home (~/.clawdbot/scripts/auto-update.sh), writes logs (~/.clawdbot/logs/auto-update.log), captures and emits full clawdhub output in SKILL_OUTPUT. These are reasonable for an updater but can surface sensitive info if update output contains error messages or other secrets.

Install Mechanism

No install spec or archive downloads are present (instruction-only). Nothing will be written to disk by the skill package itself — any files are created by the commands the agent runs. This is the lowest-risk install footprint from the skill bundle perspective.

Credentials

The skill declares no environment variables, no credentials, and references only CLI tools expected for updating (npm/pnpm/bun, git, clawdbot, clawdhub). It does not request unrelated secrets. However, global package updates can require elevated permissions; the instructions mention permission errors and advise sudo or permission fixes.

Persistence & Privilege

The skill recommends adding a cron job (persistent scheduled execution) and writing a helper script and logs to the user's home. always is false. Persistent scheduling and automatic updating are expected for this purpose, but they are powerful: automatic updates will install new code for both Clawdbot and all skills (via clawdhub update --all), which could introduce unreviewed changes if the registry or update process is compromised.

Assessment

This skill appears coherent for automatically checking and applying updates. Before enabling it, consider: 1) Run a dry-run first (clawdhub update --all --dry-run) to see what would change. 2) Review the helper script content and the log file location if you or the agent will create it (~/.clawdbot/scripts/auto-update.sh and ~/.clawdbot/logs/auto-update.log). 3) Prefer isolated sessions and limit privileges (avoid running global package updates as root if possible). 4) Decide if you want to update all skills automatically — automatic bulk updates can install new code without per-skill review; consider restricting to specific trusted skills or reviewing changelogs. 5) Ensure you have backups or a rollback plan in case an update breaks workflows. 6) If you use remote delivery (e.g., Telegram), verify destination addresses/tokens are configured securely. The scanner had no findings to analyze (instruction-only skill).

Auto-Updater Skill

Keep your Clawdbot and skills up to date automatically with daily update checks.

What It Does

This skill sets up a daily cron job that:

1. Updates Clawdbot itself (via clawdbot doctor or package manager)
2. Updates all installed skills (via clawdhub update --all)
3. Messages you with a summary of what was updated

Setup

Quick Start

Ask Clawdbot to set up the auto-updater:

Set up daily auto-updates for yourself and all your skills.

Or manually add the cron job:

clawdbot cron add \
  --name "Daily Auto-Update" \
  --cron "0 4 * * *" \
  --tz "America/Los_Angeles" \
  --session isolated \
  --wake now \
  --deliver \
  --message "Run daily auto-updates: check for Clawdbot updates and update all skills. Report what was updated."

Configuration Options

Option	Default	Description
Time	4:00 AM	When to run updates (use --cron to change)
Timezone	System default	Set with --tz
Delivery	Main session	Where to send the update summary

How Updates Work

Clawdbot Updates

For npm/pnpm/bun installs:

npm update -g clawdbot@latest
# or: pnpm update -g clawdbot@latest
# or: bun update -g clawdbot@latest

For source installs (git checkout):

clawdbot update

Always run clawdbot doctor after updating to apply migrations.

Skill Updates

clawdhub update --all

This checks all installed skills against the registry and updates any with new versions available.

Update Summary Format

After updates complete, you'll receive a message like:

🔄 Daily Auto-Update Complete

**Clawdbot**: Updated to v2026.1.10 (was v2026.1.9)

**Skills Updated (3)**:
- prd: 2.0.3 → 2.0.4
- browser: 1.2.0 → 1.2.1  
- nano-banana-pro: 3.1.0 → 3.1.2

**Skills Already Current (5)**:
gemini, sag, things-mac, himalaya, peekaboo

No issues encountered.

Manual Commands

Check for updates without applying:

clawdhub update --all --dry-run

View current skill versions:

clawdhub list

Check Clawdbot version:

clawdbot --version

Troubleshooting

Updates Not Running

1. Verify cron is enabled: check cron.enabled in config
2. Confirm Gateway is running continuously
3. Check cron job exists: clawdbot cron list

Update Failures

If an update fails, the summary will include the error. Common fixes:

• Permission errors: Ensure the Gateway user can write to skill directories
• Network errors: Check internet connectivity
• Package conflicts: Run clawdbot doctor to diagnose

Disabling Auto-Updates

Remove the cron job:

clawdbot cron remove "Daily Auto-Update"

Or disable temporarily in config:

{
  "cron": {
    "enabled": false
  }
}

Resources

• Clawdbot Updating Guide
• ClawdHub CLI
• Cron Jobs