Skills Updater
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The artifacts describe a legitimate skills updater, but its auto mode can change all installed OpenClaw skills and write persistent reports, so it should be used deliberately.
Before installing or using this skill, understand that --auto can update all detected OpenClaw skills. Use --dry-run first, review the planned changes, keep the generated backups, and check the generated memory report if you do not want update history retained.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Running auto-update can change multiple installed skills, which may alter how the user's agent behaves afterward.
The documented --auto mode can perform bulk updates to installed skills. That is expected for this skill, but it is a high-impact local mutation capability.
### Auto-upgrade all skills ```bash python3 ~/.openclaw/skills/skills-updater/scripts/check-skill-updates.py --auto ```
Run --dry-run first, review what will change, and use --auto only when the user explicitly wants all detected skill updates applied.
If a remote skill update is bad or compromised, this updater could install it across the user's local skill set.
The updater intentionally installs the latest remote skill versions. This is purpose-aligned, but it means the user relies on ClawHub package provenance and publisher integrity.
Update — Downloads and applies latest version from ClawHub
Prefer dry-run review, verify publisher/version/changelog where possible, and keep backups before applying broad updates.
Future agent sessions may see or reuse the upgrade report, and it may reveal local skill inventory or update history.
The skill writes upgrade reports into the OpenClaw memory/workspace area, creating persistent context about installed skills and updates.
Report — Writes summary to `~/.openclaw/workspace/memory/skill-upgrades-YYYY-MM-DD.md`
Review the generated memory report and delete it if the user does not want skill update history retained.
Users may be less able to confirm exactly which version they installed or whether documentation matches the packaged code.
The README contains inconsistent version labels, while the registry metadata and _meta.json also report different versions. This makes verification harder, though it does not show malicious behavior.
# Skills Updater v1.0.7 ... **Version:** 1.0.0
Verify the installed package version and do not rely solely on the README's production-ready or audit claims.