Security audit

Auto Updater

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it sets up persistent unattended updates that can modify Clawdbot and every installed skill without per-update approval.

Review this carefully before installing. Use it only if you are comfortable letting a scheduled agent update Clawdbot and every installed skill automatically. Prefer dry-run or notification-only updates, pin or approve versions where possible, and know how to remove the cron job before enabling it.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

Location: SKILL.md:31
Finding: Persistent Daily Scheduled Task Performs Unattended Software Updates
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:55
Finding: Unpinned and Unverified Automatic Supply-Chain Updates
Content: View full analysis
/dev/null && npm list -g clawdbot &> /dev/null; then npm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v pnpm &> /dev/null && pnpm list -g clawdbot &> /dev/null; then pnpm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v bun &> /dev/null; then bun update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" else log "Running clawdbot update (source install)" clawdbot update 2>&1 | tee -a "$LOG_FILE" || true fi ``` `references/agent-guide.md:65-67`: ```bash log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true echo "$SKILL_OUTPUT" >> "$LOG_FILE" ``` ### Technical Analysis The update procedure retrieves and installs mutable future releases through `@latest`, source-update behavior, and the bulk `clawdhub update --all` operation. The reviewed instructions do not require: - Exact version pinning. - Artifact hashes or lock files. - Cryptographic signature verification. - Publisher or provenance validation. - Staged security review. - Per-release user approval. This creates an unsafe supply-chain trust path. The effective code installed by the skill can change after the skill itself has been audited. A compromised publisher account, package registry, repository, or accepted dependency release could therefore distribute code that the scheduled process installs automatically. The use of `|| true` for source and skill updates also suppresses failure status. Logging and reporting may still occur, but ...[truncated 1962 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Self-Modification

High

Category: Rogue Agent
Confidence: 96% confidence
Finding: The command clawdhub update --all performs self-modification by updating all installed skills in bulk, including code the agent may later execute or rely on. Combined with unattended scheduling, this creates a direct supply-chain attack path where a malicious or compromised skill update could persist and alter future agent behavior without human review.
Content: Scanner excerpt · references/agent-guide.md (reported line 61)May include surrounding context.
md
# Capture new version CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true echo "$SKILL_OUTPUT" >> "$LOG_FILE"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs the user to create a recurring cron job that performs software updates and writes changes to the local system, but it does not clearly warn that this will automatically modify Clawdbot and all installed skills on a daily schedule. That is risky because users may enable persistent unattended updates without understanding the scope of system changes or the trust they are placing in upstream packages and skill registries.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/agent-guide.md (reported line 21)May include surrounding context.
bun pm ls -g 2>/dev/null | grep clawdbot && echo "bun-global"

text
## Step 2: Create the Update Script (Optional) For complex setups, create a helper script at `~/.clawdbot/scripts/auto-update.sh`:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide instructs configuring a daily unattended cron task that updates the core agent and all installed skills, which can change executable behavior without an explicit warning, approval gate, or trust verification. In a security-sensitive agent ecosystem, this increases supply-chain risk because compromised upstream packages or skills would be automatically pulled and applied on a schedule.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The setup confirmation message schedules unattended software updates but does not clearly warn the user that Clawdbot core and all installed skills will be modified automatically on a recurring basis. In an auto-updater context, missing explicit consent/impact language can lead users to enable persistent software changes without understanding the security, stability, or supply-chain implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The overview says the skill will check for updates, apply them, and send summaries, but it omits a clear notice that this behavior requires outbound network access and local write access to modify Clawdbot and installed skills. While not overtly malicious, this weakens informed consent and may surprise users in restricted, privacy-sensitive, or production environments.
Content: No source excerpt is available for this finding.