Ayao Updater

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:58 AM UTC
• Version: 1.0.2

Overview

This skill is transparent about auto-updating OpenClaw and skills, but it installs a persistent cron updater and contains unsafe cron/config handling that could be abused for persistent command execution.

Install only if you are comfortable allowing a user-level cron job to automatically change OpenClaw and installed skills. Prefer manual dry runs, avoid running the installer as root, keep the config file private and trusted, and review or fix the cron schedule validation, config path handling, and log-file location before enabling unattended updates.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Warning

• Location: scripts/install-cron.sh:49

Finding

Recurring Cron-Based System Persistence

Content

View full analysis

/dev/null | grep -Fv "$CRON_TAG" || true; } | crontab - echo "✅ Removed openclaw-auto-update cron job" exit 0 fi # Add new cron entry NEW_CRON="$SCHEDULE bash $UPDATE_SCRIPT >> /tmp/openclaw-auto-update.log 2>&1 $CRON_TAG" { crontab -l 2>/dev/null | grep -Fv "$CRON_TAG" || true echo "$NEW_CRON" } | crontab - ``` ### Technical Analysis The installation script modifies the current user's crontab and registers `update.sh` for recurring execution. The scheduled task survives the installer process and subsequent agent sessions, making it a system-persistence mechanism. This behavior is explicitly documented, directly supports the declared automatic-update functionality, operates with user-level privileges, and includes an uninstall operation. It therefore does not appear concealed or unrelated. Nevertheless, it creates a persistent execution path that periodically changes OpenClaw and installed Skills without requiring approval for each update. The persistent task also increases the effect of any later compromise of `update.sh`, the Skill directory, the `openclaw` or `clawhub` executables resolved through `PATH`, or the upstream update channel. ### Attack Path 1. The user runs `scripts/install-cron.sh` as documented. 2. The script removes previous crontab lines carrying its tag and adds a new recurring entry. 3. Cron subsequently executes `scripts/update.sh` according to the configured schedule. 4. The updater modifies OpenClaw and installed Skills. 5. If OpenClaw changes and gateway restart is enabled, the updater also restarts the gateway. 6. A later compromise of the scheduled script, invoked command-line tools, or update source is automatically exercised on the next scheduled run. ### Impact Assessment T ...[truncated 397 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install-cron.sh:16

Finding

Arbitrary Cron Entry Injection Through Unvalidated Schedule Input

Content

View full analysis

/dev/null || true) [[ -n "$SCHEDULE_FROM_CONFIG" ]] && SCHEDULE="$SCHEDULE_FROM_CONFIG" fi # Add new cron entry NEW_CRON="$SCHEDULE bash $UPDATE_SCRIPT >> /tmp/openclaw-auto-update.log 2>&1 $CRON_TAG" { crontab -l 2>/dev/null | grep -Fv "$CRON_TAG" || true echo "$NEW_CRON" } | crontab - ``` ### Technical Analysis The schedule is accepted from either command-line input or `config.json` and inserted directly at the beginning of a generated crontab line. The script does not verify that the value is a single-line, five-field cron expression. A value containing a newline can terminate the intended entry and introduce one or more additional crontab records. Because the resulting text is piped directly to `crontab -`, injected entries become persistent scheduled commands. Other cron-specific syntax may also alter when or how the intended command executes. Configuration data must not be treated as trusted merely because it is expected to contain a schedule. A corrupted, replaced, or attacker-supplied configuration file can transform this installation helper into a persistent arbitrary-command registration mechanism. ### Attack Path 1. An attacker gains control o ...[truncated 1070 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install-cron.sh:36

Finding

Python Code Injection Through Interpolated Configuration Path

Content

View full analysis

/dev/null || true) [[ -n "$SCHEDULE_FROM_CONFIG" ]] && SCHEDULE="$SCHEDULE_FROM_CONFIG" fi ``` ### Technical Analysis `CONFIG_FILE` is inserted directly into Python program text inside a single-quoted Python string. Shell quoting does not make this safe at the Python-language layer. A path containing a single quote and crafted Python syntax can terminate the string and inject additional Python statements. The preceding `-f` check reduces exploitability by requiring the crafted path to identify an existing regular file, but it does not sanitize the filename. On filesystems that permit quotes and other relevant characters in names, an attacker who controls `OPENCLAW_UPDATE_CONFIG` and can create the corresponding file can satisfy this condition. The correct security boundary is to pass the path as data through `argv` or an environment variable, rather than incorporating it into executable source. ### Attack Path 1. An attacker controls the environment used to invoke the installer, including `OPENCLAW_UPDATE_CONFIG`. 2. The attacker creates an existing file whose crafted pathname contains Python string-termination and statement-injection syntax. 3. The `[[ -f "$CONFIG_FILE" ]]` condition succeeds. 4. The pathname is substituted into the source passed to `python3 -c`. 5. Python parses the injected content as code rather than as filename data. 6. The injected Python statements execute with the privileges of the user running `install-cron.sh`. ### Impact Asses ...[truncated 400 chars]

Remediation

View remediation

/dev/null || true`. - Check configuration-file ownership and permissions when it affects persistent task installation. - Add regression tests using paths containing quotes, whitespace, newlines, and shell or Python metacharacters. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/update.sh:21

Finding

Predictable Temporary Log File Allows Symlink-Based File Modification

Content

View full analysis

> /tmp/openclaw-auto-update.log 2>&1 $CRON_TAG" ``` ### Technical Analysis The updater always appends to `/tmp/openclaw-auto-update.log`. `/tmp` is normally writable by all local users, and the script does not verify file ownership, file type, link count, or whether the path is a symbolic link before opening it. An attacker can pre-create the pathname as a symlink to another file. When the victim runs the updater, `tee -a` or the cron shell's append redirection follows that symlink and appends updater output to the target. The target must still be writable by the victim account, but this can corrupt user-owned files or manipulate files consumed by other user-level processes. A local attacker can also pre-create the log as an ordinary file and tamper with or suppress the integrity of audit records. ### Attack Path 1. A local attacker predicts the fixed pathname `/tmp/openclaw-auto-update.log`. 2. Before the updater or cron task runs, the attacker creates that path as a symbolic link to a file writable by the victim account. 3. The scheduled or manual updater opens the fixed path for append. 4. The operating system follows the symlink. 5. Update output is appended to the attacker-selected targe ...[truncated 531 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill is explicitly designed to update OpenClaw and installed skills automatically, which is a real self-modification capability. Even if intended for maintenance, automatic fetching and installing of code changes expands the trusted code base and can introduce supply-chain risk, especially because it updates all installed skills on a schedule with limited human review.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: ayao-updater
description: Automatically update OpenClaw and all installed skills on a schedule. Use when: (1) setting up automatic updates for OpenClaw or skills, (2) running a manual update check, (3) configuring update schedule, skip lists, or pre-release filtering, (4) user says "auto update", "schedule updates", "keep openclaw updated", "update skills automatically". Handles locally-modified skill protection, conflict avoidance, pre-release filtering, and completion or failure notifications.
---

# OpenClaw Auto Update

Self-Modification

High

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

This script automatically updates all installed skills by invoking clawhub update on enumerated skill slugs, which is a form of self-modification/runtime code replacement. If the skill source, registry, dependency chain, or transport is compromised, the script will pull and install attacker-controlled updates across the local skill set with minimal operator review.

Content

Scanner excerpt · scripts/update.sh (reported line 252)May include surrounding context.

sh

fi
  fi

  # ── Update Skills ─────────────────────────────────────────────────────────
  log_section "Updating Skills"
  local skills_updated=0
  local skills_skipped=0

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

Configuration

Create ~/.openclaw/workspace/skills/openclaw-auto-update/config.json:

json

{

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

This script installs and removes a persistent cron job, which is a legitimate persistence mechanism but still creates code that will execute repeatedly in the user's context. In a skill package, that is security-relevant because it establishes ongoing execution outside the normal agent/session lifecycle, and the referenced update script path is inserted into crontab without hardening or explicit user confirmation at install time.

Content

Scanner excerpt · scripts/install-cron.sh (reported line 50)May include surrounding context.

sh

fi

if [[ "$UNINSTALL" == "true" ]]; then
  { crontab -l 2>/dev/null | grep -Fv "$CRON_TAG" || true; } | crontab -
  echo "✅ Removed openclaw-auto-update cron job"
  exit 0
fi

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

This line adds a cron entry that causes periodic execution of an update script, which is a true persistence behavior and expands risk because future code changes in update.sh will be executed automatically. The danger is increased by taking the schedule from a config file and writing logs to /tmp, while constructing the cron command from unquoted variables, making the persisted command more fragile and potentially abusable if paths or config are manipulated.

Content

Scanner excerpt · scripts/install-cron.sh (reported line 58)May include surrounding context.

sh

# Add new cron entry
NEW_CRON="$SCHEDULE bash $UPDATE_SCRIPT >> /tmp/openclaw-auto-update.log 2>&1 $CRON_TAG"
{
  crontab -l 2>/dev/null | grep -Fv "$CRON_TAG" || true
  echo "$NEW_CRON"
} | crontab -

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/update.sh (reported line 4)May include surrounding context.

sh

#!/usr/bin/env bash
# openclaw-auto-update/scripts/update.sh
# Automatically updates OpenClaw and installed skills.
# Uses the built-in OpenClaw updater, handles conflicts, respects skiplist,
# and sends notifications.
#
# Usage:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/update.sh (reported line 114)May include surrounding context.

sh

#!/usr/bin/env bash
# openclaw-auto-update/scripts/update.sh
# Automatically updates OpenClaw and installed skills.
# Uses the built-in OpenClaw updater, handles conflicts, respects skiplist,
# and sends notifications.
#
# Usage:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/update.sh (reported line 278)May include surrounding context.

sh

#!/usr/bin/env bash
# openclaw-auto-update/scripts/update.sh
# Automatically updates OpenClaw and installed skills.
# Uses the built-in OpenClaw updater, handles conflicts, respects skiplist,
# and sends notifications.
#
# Usage:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/update.sh (reported line 280)May include surrounding context.

sh

#!/usr/bin/env bash
# openclaw-auto-update/scripts/update.sh
# Automatically updates OpenClaw and installed skills.
# Uses the built-in OpenClaw updater, handles conflicts, respects skiplist,
# and sends notifications.
#
# Usage:

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/update.sh (reported line 137)May include surrounding context.

sh

return 1  # not modified
}

# ── Enumerate installed skills ────────────────────────────────────────────────
list_installed_skills() {
  local listed=false

Static analysis

No suspicious patterns detected.