ClawDoctor

Self-healing doctor for OpenClaw. Monitors gateway, crons, sessions, auth, and costs. Sends Telegram alerts. Auto-restarts gateway when it goes down. Use whe...

Security Scan

The skill's behavior (monitoring logs, restarting the gateway, sending Telegram alerts) matches its description, but there are provenance and declaration inconsistencies — notably an unsigned npm install with no homepage and missing declared dependencies/credentials — that warrant caution before installing.

Purpose & Capability

The SKILL.md clearly monitors OpenClaw state and takes healing actions (restarting the gateway) — this is coherent with the name/description. However, the skill runtime invokes 'openclaw gateway restart' and reads OpenClaw state/log files, yet the registry metadata only lists 'clawdoctor' as a required binary; 'openclaw' is not declared as a required binary. The SKILL.md also shows examples that accept a Telegram token/chat, but no required env vars or primary credential are declared. These omissions are inconsistent with the described capabilities.

Instruction Scope

Instructions are explicit about reading ~/.openclaw state, sessions, and gateway logs (read-only) and executing a healing command ('openclaw gateway restart'). It also documents non-interactive setup, installing a systemd user service, and starting a long-running daemon. These actions are within the stated monitoring/healing scope, but they grant the tool authority to read local OpenClaw data and restart services — and the docs don't explain exact token storage/handling or whether the agent should pass Telegram credentials via env vs CLI flags.

Install Mechanism

The install spec is 'npm install -g clawdoctor' (global npm package). Installing a third-party npm package globally can execute arbitrary code on the host. The SKILL.md lists a homepage (https://clawdoctor.dev) but the registry metadata shows 'Source: unknown' and no authoritative homepage in the registry entry; the package owner/registry provenance is not clearly verifiable here. This is a moderate-to-high supply-chain risk unless the npm package and its repository are audited.

Credentials

The skill legitimately needs access to OpenClaw's files and the ability to run the 'openclaw' command to heal. It also needs a Telegram bot token/chat ID to send alerts. However, none of these credentials or the 'openclaw' binary are declared in requires.env or requires.bins in the registry metadata. The SKILL.md's examples require a TOKEN and CHATID but the registry doesn't declare or require them — that's a transparency gap.

Persistence & Privilege

The skill can be installed as a persistent systemd user service and run as a daemon that restarts the OpenClaw gateway — this gives it continuous execution and the ability to perform potentially disruptive actions (restarts). The skill does not request 'always: true', but installing the service effectively grants ongoing privileges. Users should recognize the operational impact and verify the package before granting that persistence.

What to consider before installing

This skill appears to do what it claims (monitor OpenClaw and restart the gateway), but there are red flags you should address before installing: 1) Verify the npm package source and repository (review the package code, maintainer, and release history). Do not install a global npm package you can't audit. 2) Confirm the presence and trustworthiness of the 'openclaw' binary on the host; the registry metadata should have declared it. 3) Run clawdoctor in dry-run mode first (clawdoctor start --dry-run) and review its logs/events before enabling auto-heal. 4) When configuring Telegram, restrict the bot permissions and avoid placing tokens in world-readable files; prefer per-service tokens and secrets management. 5) If possible, run the tool under a limited user account or inside a container to reduce blast radius of an arbitrary npm package. Additional information that would raise confidence: a visible package repository or homepage with source code, verifiable package maintainers, and explicit declared requirements (openclaw binary and required env vars) in the registry metadata.

ClawDoctor - Self-Healing Doctor for OpenClaw

Monitors your OpenClaw setup and fixes problems before you notice them.

Built for people running OpenClaw in production who got tired of checking if things were still alive.

npm: clawdoctor | Version: 0.2.0 | License: MIT

What It Monitors

Monitor	What It Watches	Interval
GatewayWatcher	openclaw process running	30s
CronWatcher	~/.openclaw/state/cron-*.json for missed/failed crons	60s
SessionWatcher	~/.openclaw/agents/*/sessions/*.jsonl for errors, aborts, stuck sessions	60s
AuthWatcher	Gateway logs for 401/403/token expired patterns	60s
CostWatcher	Session token costs - flags if >3x rolling average	5m

What It Fixes

Healer	Action
ProcessHealer	Restarts gateway via openclaw gateway restart, then verifies recovery
CronHealer	Logs the failure and includes the manual rerun command in the alert

Install

npm install -g clawdoctor
clawdoctor init
clawdoctor start

When to Use

• You run OpenClaw in production
• You have cron jobs that sometimes fail silently
• You want Telegram alerts when something breaks
• You want the gateway to auto-restart if it goes down

Commands

clawdoctor init              # Interactive setup (detects OpenClaw, configures Telegram)
clawdoctor start             # Start monitoring daemon
clawdoctor start --dry-run   # Run without taking healing actions
clawdoctor stop              # Stop daemon
clawdoctor status            # Show current health of all monitors
clawdoctor log               # Show recent events
clawdoctor log -n 100        # Show 100 events
clawdoctor log -w GatewayWatcher -s critical  # Filter by watcher/severity
clawdoctor install-service   # Install as systemd user service

Non-Interactive Setup (for agents)

clawdoctor init \
  --openclaw-path ~/.openclaw \
  --telegram-token TOKEN \
  --telegram-chat CHATID \
  --auto-fix \
  --no-prompt

Sample Alert

Alert: GatewayWatcher
Event: Gateway process not found
Action: openclaw gateway restart
Status: Back online
Time: 2026-03-15 03:14 UTC
Host: devbox

Alerts are rate-limited to max 1 per monitor per 5 minutes to avoid spam.

Configuration

Config lives at ~/.clawdoctor/config.json. Events stored in ~/.clawdoctor/events.db (SQLite, 7-day retention).

Pricing

• Diagnose ($9/mo): Monitoring + Telegram alerts https://buy.stripe.com/7sY14g2fsex33F08U51ck01
• Heal ($19/mo): Everything in Diagnose + auto-healing actions https://buy.stripe.com/eVq28k2fsdsZ7Vg6LX1ck02

Security

• Reads OpenClaw log/state files (read-only)
• Only action taken: openclaw gateway restart when gateway is down
• Sends alerts via Telegram Bot API (outbound HTTPS only)
• No data sent to external servers in free tier
• No API keys or conversation content leaves the machine

More Info

https://clawdoctor.dev