Ayao Updater

Automatically updates OpenClaw and installed skills on a configurable schedule, handling package manager detection, local changes, and notifications.

Security Scan

The skill's files and scripts are consistent with an auto-updater for OpenClaw and installed skills; no obvious exfiltration or unrelated credential requests were found, though there are minor inconsistencies and you should review cron/install actions before enabling.

Purpose & Capability

The name/description match the actual behavior: the scripts call openclaw and clawhub to enumerate and update the platform and skills, handle local git changes, and notify the user. Minor inconsistencies in naming/pathing are present (SKILL.md and examples reference openclaw-auto-update, registry slug is ayao-updater, and smoke-test references a different folder), which looks like copy/paste sloppiness rather than malicious redirection.

Instruction Scope

Instructions and scripts stay inside the updater use-case: they read a JSON config (default location or overridden by OPENCLAW_UPDATE_CONFIG), call openclaw/clawhub, check git status of skill directories, write logs to /tmp, and (optionally) install a cron job. They do not embed network endpoints or attempt to read unrelated system files. The scripts will run commands that depend on external CLIs (openclaw, clawhub) — those binaries are executed with the privileges of the user running the updater, so trust in those CLIs is important.

Install Mechanism

No external install/downloads or archive extraction are present; this is an instruction-only skill with local shell scripts. install-cron.sh manipulates the user's crontab (expected for a scheduler) and logs to /tmp. No suspicious URLs or remote code fetching were found.

Credentials

No credentials or sensitive environment variables are requested. Optional environment overrides (OPENCLAW_UPDATE_CONFIG, OPENCLAW_WORKSPACE) are documented and reasonable. The scripts rely on the presence of openclaw, clawhub, python3, and bash, which is proportionate to the stated purpose.

Persistence & Privilege

The skill does not set always:true. It can install a persistent cron job (via install-cron.sh) which will run the updater on the schedule — this is expected for an auto-updater but is a persistent change to the user's crontab that the user must opt into. It writes logs to /tmp and invokes system commands (including optional gateway restart).

Assessment

This skill appears to do what it says: schedule and run OpenClaw and skill updates. Before installing, review and/or run the scripts manually in dry-run mode: 1) Inspect scripts/update.sh to confirm the notification target behavior and any command outputs you consider sensitive. 2) Run update.sh --dry-run to see planned actions; the script also supports a config file at ~/.openclaw/workspace/skills/openclaw-auto-update/config.json or a custom path via OPENCLAW_UPDATE_CONFIG. 3) The install script will modify your crontab and create a cron entry that runs the updater and writes to /tmp/openclaw-auto-update.log — if you do not want persistent scheduling, do not run install-cron.sh. 4) Ensure the openclaw and clawhub binaries on your machine are from trusted sources, because the updater will invoke them. 5) Note the minor naming/path inconsistencies in the files (ayao-updater vs openclaw-auto-update) — confirm you use the correct path when installing. If you want extra caution, run the smoke-test and review the output before enabling the cron job.

OpenClaw Auto Update

Keeps OpenClaw and installed ClawHub skills up to date automatically.

Prerequisites

• openclaw CLI — required for openclaw update, openclaw gateway restart, and notifications
• clawhub CLI — required for clawhub list, clawhub inspect, and clawhub update
• python3 — required for loading config.json
• bash 4+ — required by the shell scripts for associative arrays and other modern Bash features

Quick Start

1. Install cron job (runs daily at 2 AM by default)

bash ~/.openclaw/workspace/skills/openclaw-auto-update/scripts/install-cron.sh

2. Run manually now

bash ~/.openclaw/workspace/skills/openclaw-auto-update/scripts/update.sh

3. Preview what would be updated (no changes)

bash ~/.openclaw/workspace/skills/openclaw-auto-update/scripts/update.sh --dry-run

Configuration

Create ~/.openclaw/workspace/skills/openclaw-auto-update/config.json:

{
  "schedule": "0 2 * * *",
  "skipSkills": [],
  "skipPreRelease": true,
  "restartGateway": true,
  "notify": true,
  "notifyTarget": null
}

See references/config-schema.md for all options and examples.

What It Does

1. Loads JSON config — reads config.json with python3 and merges defaults
2. Updates OpenClaw — runs openclaw update --yes --no-restart; in preview mode it logs the equivalent openclaw update --dry-run --yes --no-restart command without making changes
3. Finds installed skills — enumerates skills via clawhub list, with workspace directory fallback
4. Checks release channel — uses clawhub inspect <slug> to skip pre-releases when skipPreRelease: true
5. Updates skills — runs clawhub update <slug> --no-input for each eligible installed skill; in preview mode it only logs clawhub update --all because the installed clawhub CLI does not support update dry runs
6. Protects local changes — skips skills with uncommitted git changes
7. Respects skip list — never touches skills in skipSkills
8. Restarts gateway — only if OpenClaw version actually changed
9. Notifies — sends openclaw message send --target <target> -m <message> when notifyTarget is set, otherwise openclaw system event --text <message> --mode now

Change Schedule

# Change to 3 AM weekly on Sunday
bash ~/.openclaw/workspace/skills/openclaw-auto-update/scripts/install-cron.sh --schedule "0 3 * * 0"

# Uninstall cron job
bash ~/.openclaw/workspace/skills/openclaw-auto-update/scripts/install-cron.sh --uninstall

Logs

tail -f /tmp/openclaw-auto-update.log

Skip a Specific Skill Permanently

Add to config.json:

{ "skipSkills": ["my-custom-skill", "work-internal"] }