T06 · System Persistence
Error
- Location
SKILL.md:23- Finding
Persistent Daily Execution Through an Automatically Installed Cron Job
- Content
View full analysis
- Remediation
View remediation
Security audit
Xiaopi Auto Updater
Security checks for vulnerabilities and agentic risk
Overview
This skill openly sets up unattended daily updates, but that gives persistent authority to change the bot and all installed skills without review at each run.
Install only if you intentionally want Clawdbot to update itself and every installed skill automatically. Prefer a dry-run or notification-only schedule, pin or approve versions before installation, and confirm you know how to list and remove the `Daily Auto-Update` cron job.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:48- Finding
Unpinned Automatic Updates Allow Supply-Chain Payload Installation
- Content
View full analysis
/dev/null && npm list -g clawdbot &> /dev/null; then npm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v pnpm &> /dev/null && pnpm list -g clawdbot &> /dev/null; then pnpm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v bun &> /dev/null; then bun update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" else log "Running clawdbot update (source install)" clawdbot update 2>&1 | tee -a "$LOG_FILE" || true fi # Run doctor for migrations log "Running doctor..." clawdbot doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true echo "$SKILL_OUTPUT" >> "$LOG_FILE" ``` ### Technical Analysis The update process installs mutable `latest` package content and updates every installed Skill without pinning expected versions, verifying signatures or checksums, validating publisher provenance, reviewing changes, or requesting approval for each update. Because the effective code is selected at execution time, the content installed by the scheduled process can differ from the content available when this Skill was audited. Updating all Skills further expands the trust boundary to every relevant registry publisher. After installation, the procedure in ...[truncated 2052 chars]- Remediation
View remediation
Vulnerability Patterns
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 97% confidence
- Finding
The script performs
clawdhub update --all, which self-modifies the agent's installed capabilities by replacing or altering skills from an external source. This is dangerous because it expands the trusted computing base and enables supply-chain compromise or behavioral drift in future agent runs without manual review.- Content
md # Capture new version CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true echo "$SKILL_OUTPUT" >> "$LOG_FILE"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This skill explicitly configures unattended daily updates for both the core bot and all installed skills, which can modify executing software without a fresh user approval at the time of change. Even if intended for convenience, automatic update behavior increases supply-chain and operational risk because a compromised registry, bad release, or incompatible update could be pulled and applied automatically.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The guide promotes unattended daily updates of the core bot and installed skills without requiring explicit user acknowledgment of the risks of automatic software changes. This is dangerous because it can introduce breaking changes, supply-chain compromise, or unintended behavior changes without human review, especially when skills are also updated automatically.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bun pm ls -g 2>/dev/null | grep clawdbot && echo "bun-global"
text ## Step 2: Create the Update Script (Optional) For complex setups, create a helper script at `~/.clawdbot/scripts/auto-update.sh`:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The cron job is configured to execute update and migration actions automatically, including
clawdbot doctor --yesandclawdhub update --all, with no user-facing warning or approval gate. This increases risk because it combines unattended package changes, migrations, and agent-delivered execution on a schedule, making accidental breakage or malicious upstream updates harder to detect before they take effect.- Content
Static analysis
No suspicious patterns detected.