blessonism Dependency Tracker
Track version drift across all OpenClaw dependencies. Detect updates, generate reports, notify Boss.
Quick Start
# 1. Scan — build/refresh the local manifest
python3 scripts/scan.py
# 2. Check — compare local vs remote versions
python3 scripts/check.py
# 3. Report — generate human-readable Markdown report
python3 scripts/report.py
All scripts are in the skill directory: ~/.openclaw/workspace/skills/dependency-tracker/scripts/
What It Tracks
| Category | Source | Detection Method |
|---|---|---|
| Managed skills (GitHub) | .skill-lock.json |
GitHub Contents API (git hash compare) |
| Managed skills (ClewHub) | _meta.json |
ClewHub API (version compare) |
| Bundled skills | /app/skills/ |
Tied to OpenClaw version |
| Workspace skills | workspace/skills/ |
Local git (self-managed) |
| OpenClaw version | npm registry + GitHub | npm view / GitHub Releases API |
| npm dependencies | /app/node_modules/ |
npm outdated |
| pip packages | system Python | pip3 list --outdated |
| CLI tools | PATH | Version commands |
Workflow
On-Demand Check
When user asks to check dependencies:
- Run
scan.pyto refresh the manifest - Run
check.pyto compare against remote sources - Run
report.pyto generate the report - Send report summary to user (Telegram)
- If unknown-source skills found, notify Boss
Scheduled Check (Cron)
Set up a weekly cron job:
- Run all three scripts in sequence
- Push report summary to Telegram
- Only notify if updates are found or errors occur
Data Files
All runtime data lives in data/ (gitignored from backup):
data/
├── manifest.json # Full dependency inventory
├── check-results.json # Latest check results
└── reports/
└── YYYY-MM-DD-report.md # Generated reports
Key Design Decisions
- No auto-update: Only detect and report. User decides when to update.
- GitHub hash comparison: Uses
git hash-objectlocally vs GitHub Contents API SHA — exact match, no false positives. - Lock file as source of truth:
.skill-lock.json(OpenClaw's managed skill registry) provides repo URLs and install metadata. - Changelog extraction: For GitHub skills with updates, fetches recent commits for context.
- Unknown source notification: Skills without traceable source are flagged and reported to Boss.