openclaw-live-updater
Pass
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
update-main.mjsto execute various system commands includinggit,pnpm,plutil, andlaunchctl. These are strictly scoped to managing the local OpenClaw deployment and its associated macOS services. - [EXTERNAL_DOWNLOADS]: The skill interacts with GitHub via
git fetchand the GitHub CLI (gh workflow run). These operations are targeted at the officialopenclaw/openclawrepository, which is consistent with the skill's stated purpose. - [DATA_EXFILTRATION]: The maintenance script includes proactive security measures such as explicitly clearing sensitive environment variables (e.g.,
OPENCLAW_GATEWAY_TOKEN,OPENCLAW_GATEWAY_PASSWORD) before executing the application CLI to prevent data exposure. - [INDIRECT_PROMPT_INJECTION]: The agent processes external inputs such as Git logs and application logs for diagnostics. It mitigates risks by implementing strict validation of commit SHAs, file paths, and ownership before any data is ingested or acted upon.
- [COMMAND_EXECUTION]: The skill manages persistence through a macOS LaunchAgent (
ai.openclaw.gateway.plist). The script performs extensive validation of the plist file's ownership, permissions, and internal arguments to ensure it only manages the intended, verified service.
Audit Metadata