Security audit
Security checks across malware telemetry and agentic risk
This is a plausible maintenance skill, but it can alter system packages and OpenClaw skills in ways that its own safety documentation understates or contradicts.
Install only after reviewing the automation policy. Use a dedicated low-privilege account, keep sudoers restricted to exact documented commands, and inspect or disable the apt install/autoremove paths and report-time skill update. Do not treat report_9am or apt_maint.py --dry-run as fully side-effect-free, and decide explicitly whether unattended OpenClaw skill updates are acceptable on the host.
# Skills section
try:
result = subprocess.run(
["clawhub", "list"], capture_output=True, text=True, timeout=30
)
if result.returncode == 0 and result.stdout:pkg_maint_path = Path(__file__).parent / "pkg_maint.py"
if pkg_maint_path.exists():
log.info("Running: pkg_maint.py check for npm/brew")
cp_check = subprocess.run(
["python3", str(pkg_maint_path), "check"],
capture_output=True, text=True, timeout=180
)log.warning("pkg_maint.py check: rc=%d, err=%s", cp_check.returncode, cp_check.stderr[:200])
log.info("Running: pkg_maint.py upgrade for npm/brew planned packages")
cp_upgrade = subprocess.run(
["python3", str(pkg_maint_path), "upgrade"],
capture_output=True, text=True, timeout=600
)skills_updated = []
skills_with_changes = []
try:
update_result = subprocess.run(
["clawhub", "update", "--all", "--no-input"],
capture_output=True, text=True, timeout=60
)meta.get("reviewedAt")
and not meta.get("planned")
and not meta.get("blocked")
and ("review ok" in note or "auto-approved" in note)
):
meta["planned"] = True
recovered += 1if result == ReviewResult.OK:
updated["planned"] = True
updated["blocked"] = False
updated["note"] = f"Auto-approved: {reason}"
logger.info(f"✅ {manager}/{name}: {reason}")
elif result == ReviewResult.BLOCKED:
updated["blocked"] = True- Python 3.10+ (stdlib only, no dependencies) - Ubuntu with `unattended-upgrades` installed - Sudo NOPASSWD for apt-get and unattended-upgrade (see [docs/sudoers.md](docs/sudoers.md)) ## Directory Structure
- Node.js + npm (for npm packages) - Homebrew (for brew packages) - OpenClaw with clawhub CLI - sudo access for specific apt commands (see below) ## Sudoers Configuration
# Sudoers Setup sys-updater requires passwordless sudo for specific apt commands. ## Required Commands
ap.add_argument(
"--dry-run", "-n",
action="store_true",
help="Don't execute sudo commands, just log what would happen",
)
ap.add_argument(
"--verbose", "-v",log = _setup_logging(verbose=True)
if _dry_run:
log.info("DRY-RUN mode enabled: sudo commands will be skipped")
exit_code = 0
try:else:
log.debug("Skill %s already up to date", slug)
else:
log.error("Failed to update skill %s: %s", slug, stderr[:200])
result["failed"].append({"name": slug, "error": stderr[:200]})
return resultblocked_count = _count_flag(tracked_by_manager, "blocked")
log.info("Summary: planned=%d, blocked=%d", planned_count, blocked_count)
# Update skills immediately (no quarantine for skills)
log.info("Updating OpenClaw skills...")
skills_result = check_skills()
if skills_result["installed"]:formatter_class=argparse.RawDescriptionHelpFormatter,
epilog="""
Modes:
check - Update tracked state + auto-update skills (run daily in run_6am)
review - Show packages due for bug review (after 2 days)
upgrade - Apply planned npm/pnpm/brew upgrades
skills - Update OpenClaw skills immediately (no quarantine)65/65 vendors flagged this skill as clean.
No suspicious patterns detected.