OpenClaw Docs Sync

Synchronize OpenClaw, ClawHub, and Skills repository documentation into a local mirror and index it with QMD for fast search.

What it does

• Pulls .md and .mdx files from:
  • https://github.com/openclaw/openclaw/tree/main/docs
  • https://github.com/openclaw/clawhub/tree/main/docs
  • https://github.com/openclaw/skills/tree/main/skills
• Writes to ~/.openclaw/docs/ with subdirectories for each repo
• Builds a QMD collection (openclaw-docs) with embeddings for search
• Scans for supply chain attack patterns (see Security below)

Run

npx tsx scripts/sync-docs.ts

Query with QMD

# Combined semantic + BM25 search
qmd query "your question" -c openclaw-docs --files -n 20

# Get specific file
qmd get <file>:<line>

Working config example (OpenClaw.json)

This is the memory config I use and it works. You must set the paths to match your local folders and the locations created by scripts/sync-docs.ts.

If you run the script as‑is, your docs are written under:

• ~/.openclaw/docs/openclaw-docs
• ~/.openclaw/docs/clawhub-docs
• ~/.openclaw/docs/openclaw-skills

Point paths[].path at one or more of those directories (or any custom location you sync to).

"memory": {
  "backend": "qmd",
  "citations": "auto",
  "qmd": {
    "command": "qmd",
    "includeDefaultMemory": true,
    "paths": [
      {
        "path": "/example/path/to/documents",
        "name": "example-docs",
        "pattern": "**/*.md"
      }
    ],
    "sessions": {
      "enabled": true,
      "retentionDays": 30
    },
    "update": {
      "interval": "5m",
      "debounceMs": 15000,
      "onBoot": true,
      "embedInterval": "1h"
    },
    "limits": {
      "maxResults": 6,
      "maxSnippetChars": 700,
      "maxInjectedChars": 4000,
      "timeoutMs": 4000
    },
    "scope": {
      "default": "deny",
      "rules": [
        {
          "action": "allow",
          "match": {
            "chatType": "direct"
          }
        }
      ]
    }
  }
}

Notes:

• If you want to index .mdx files too, widen the pattern to **/*.{md,mdx}.
• The name is just a stable label for the collection; pick whatever you like.

Security Scanning

This sync includes detection for supply chain attacks where malicious actors inject prompt injection or shell droppers into skill documentation.

What gets flagged

Threats are logged to ~/.openclaw/security-scan.log (overwritten each sync). Files are still imported—this is detection, not blocking.

Whitelisted (not flagged)

To reduce false positives in documentation, the scanner whitelists: