
from upgrade-guard10
Safely perform OpenClaw upgrades with snapshots, pre-flight checks, controlled upgrade steps, verification, and emergency rollback to avoid breaking production
Upgrade Guard provides a safe, repeatable workflow for upgrading OpenClaw installations. It automates snapshots of current state, runs pre-flight checks, performs a controlled multi-step upgrade (with build and dependency steps), verifies the system post-upgrade, and offers an emergency rollback path if anything fails. It also includes an optional watchdog for ongoing system health and automatic recovery.
Use Upgrade Guard whenever you need to update an OpenClaw deployment or its dependencies—especially on production gateways or remote servers where an upgrade failure would be disruptive. Run its snapshot and check steps before any git pull && pnpm install cycle, and use the upgrade/verify commands for safe rollout.
Best suited for agents that can run shell commands and manage system services (CLI-capable agents, Copilot/Codex-like tooling, and autonomous maintenance agents).
Upgrade Guard provides safe OpenClaw upgrades with snapshot, pre-flight checks, controlled upgrade steps, post-verification, and emergency rollback. Both scripts ran cleanly and displayed well-structured help output. The upgrade-guard.sh has a comprehensive 6-step upgrade workflow with auto-rollback on failure, and watchdog.sh adds OS-level monitoring with systemd timer support, resource tracking, and Telegram alerts. Security concerns include auto git pull without confirmation (-18), shell injection risk from unquoted/interpolated Python paths in bash (-12), and the watchdog reading Telegram bot tokens from config to send external API calls (-15 for network calls/phone-home pattern).
Well-structured DevOps skill born from real operational pain (7 cascading failures). Good error handling, idempotent design, clear separation between upgrade and watchdog concerns. Main security deductions: auto git pull (-18), shell injection risk from unquoted Python interpolation in bash (-12), phone-home via Telegram API using config bot token (-15). Code quality is high with proper set -euo pipefail, color-coded output, and comprehensive verification steps. Architecture follows skill spec reasonably well but SKILL.md is fairly long and could benefit from moving detailed tables to references/.