Auto Updater

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.0

Overview

This skill does what it says, but it sets up persistent unattended updates that can modify Clawdbot and every installed skill without per-update approval.

Review this carefully before installing. Use it only if you are comfortable letting a scheduled agent update Clawdbot and every installed skill automatically. Prefer dry-run or notification-only updates, pin or approve versions where possible, and know how to remove the cron job before enabling it.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:31
• Finding: Persistent Daily Scheduled Task Performs Unattended Software Updates<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:31-39`; `references/agent-guide.md:77-100` **Vulnerability Type**: Persistent scheduled task **Risk Level**: High ### Vulnerable Code `SKILL.md:31-39`: ```bash clawdbot cron add \ --name "Daily Auto-Update" \ --cron "0 4 * * *" \ --tz "America/Los_Angeles" \ --session isolated \ --wake now \ --deliver \ --message "Run daily auto-updates: check for Clawdbot updates and update all skills. Report what was updated." ``` `references/agent-guide.md:77-100`: ```bash clawdbot cron add \ --name "Daily Auto-Update" \ --cron "0 4 * * *" \ --tz "America/Los_Angeles" \ --session isolated \ --wake now \ --deliver \ --message "Run the daily auto-update routine: 1. Check and update Clawdbot: - For npm installs: npm update -g clawdbot@latest - For source installs: clawdbot update - Then run: clawdbot doctor --yes 2. Update all skills: - Run: clawdhub update --all 3. Report back with: - Clawdbot version before/after - List of skills that were updated (name + old version → new version) - Any errors encountered Format the summary clearly for the user." ``` ### Technical Analysis The skill directs the agent to install a recurring cron entry that survives the originating session. The job wakes an isolated agent session every day and instructs it to execute software-maintenance commands. This is a cross-session persistence mechanism under the `T06: System Persistence` classification. Although the scheduled behavior is disclosed as the skill's intended purpose, it creates a durable execution channel. Updates are applied without requiring separate user approval for each new release. Consequently, the code executed by future runs can differ from the code that existed when the user enabled the skill. The persistence mechanism is particularly consequential because the scheduled message combines core application updates, migrations, and updates to every installed ski ...[truncated 1469 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default to a scheduled update check rather than automatic installation. 2. Require explicit user approval before applying each core or skill update. 3. Display the proposed versions, source, integrity information, and relevant release notes before installation. 4. Pin approved versions instead of instructing the scheduler to retrieve mutable latest releases. 5. Run update validation in a restricted staging environment before modifying the active installation. 6. Execute the scheduler under a dedicated least-privileged account with write access only to required update directories. 7. Provide and verify an immediate removal procedure, such as: ```bash clawdbot cron remove "Daily Auto-Update" clawdbot cron list ``` 8. Record the cron job identifier, creation time, owner, and exact commands so users can audit persistent state. 9. Require renewed authorization before materially changing the commands performed by the scheduled job. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:55
• Finding: Unpinned and Unverified Automatic Supply-Chain Updates<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:55-65`; `references/agent-guide.md:37-45, 65-67, 83-91` **Vulnerability Type**: Unsafe automatic dependency and component updates **Risk Level**: High ### Vulnerable Code `SKILL.md:55-65`: ```bash npm update -g clawdbot@latest # or: pnpm update -g clawdbot@latest # or: bun update -g clawdbot@latest ``` ```bash clawdbot update ``` ```bash clawdhub update --all ``` `references/agent-guide.md:37-45`: ```bash if command -v npm &> /dev/null && npm list -g clawdbot &> /dev/null; then npm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v pnpm &> /dev/null && pnpm list -g clawdbot &> /dev/null; then pnpm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v bun &> /dev/null; then bun update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" else log "Running clawdbot update (source install)" clawdbot update 2>&1 | tee -a "$LOG_FILE" || true fi ``` `references/agent-guide.md:65-67`: ```bash log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true echo "$SKILL_OUTPUT" >> "$LOG_FILE" ``` ### Technical Analysis The update procedure retrieves and installs mutable future releases through `@latest`, source-update behavior, and the bulk `clawdhub update --all` operation. The reviewed instructions do not require: - Exact version pinning. - Artifact hashes or lock files. - Cryptographic signature verification. - Publisher or provenance validation. - Staged security review. - Per-release user approval. This creates an unsafe supply-chain trust path. The effective code installed by the skill can change after the skill itself has been audited. A compromised publisher account, package registry, repository, or accepted dependency release could therefore distribute code that the scheduled process installs automatically. The use of `|| true` for source and skill updates also suppresses failure status. Logging and reporting may still occur, but ...[truncated 1962 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an explicitly approved version. 2. Pin every core and skill update to a known version and immutable artifact digest. 3. Verify cryptographic signatures, checksums, publisher identity, and registry provenance before installation. 4. Generate an update plan first, showing old and new versions without modifying the active installation. 5. Require user approval after presenting the proposed update plan. 6. Download and inspect updates in a sandbox with no access to production credentials or sensitive agent data. 7. Run static analysis, malware scanning, and behavioral tests before promoting an update. 8. Back up the current core and skill versions and provide an atomic rollback process. 9. Avoid bulk automatic updates where possible; validate and promote each component independently. 10. Remove broad failure suppression such as `|| true`. Capture explicit exit statuses, stop on integrity-critical failures, and clearly mark partial updates. 11. Restrict package-manager network access to approved registries and use registry namespace controls where supported. 12. Maintain an allowlist of approved package names, publishers, versions, and hashes. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Self-Modification

High

• Category: Rogue Agent

Content

# Capture new version
CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown")

# Update skills
log "Updating skills via ClawdHub..."
SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true
echo "$SKILL_OUTPUT" >> "$LOG_FILE"

• Confidence: 96% confidence
• Finding: The command `clawdhub update --all` performs self-modification by updating all installed skills in bulk, including code the agent may later execute or rely on. Combined with unattended scheduling, this creates a direct supply-chain attack path where a malicious or compromised skill update could persist and alter future agent behavior without human review.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the user to create a recurring cron job that performs software updates and writes changes to the local system, but it does not clearly warn that this will automatically modify Clawdbot and all installed skills on a daily schedule. That is risky because users may enable persistent unattended updates without understanding the scope of system changes or the trust they are placing in upstream packages and skill registries.

Session Persistence

Medium

• Category: Rogue Agent

Content

bun pm ls -g 2>/dev/null | grep clawdbot && echo "bun-global"
```

## Step 2: Create the Update Script (Optional)

For complex setups, create a helper script at `~/.clawdbot/scripts/auto-update.sh`:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide instructs configuring a daily unattended cron task that updates the core agent and all installed skills, which can change executable behavior without an explicit warning, approval gate, or trust verification. In a security-sensitive agent ecosystem, this increases supply-chain risk because compromised upstream packages or skills would be automatically pulled and applied on a schedule.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The setup confirmation message schedules unattended software updates but does not clearly warn the user that Clawdbot core and all installed skills will be modified automatically on a recurring basis. In an auto-updater context, missing explicit consent/impact language can lead users to enable persistent software changes without understanding the security, stability, or supply-chain implications.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The overview says the skill will check for updates, apply them, and send summaries, but it omits a clear notice that this behavior requires outbound network access and local write access to modify Clawdbot and installed skills. While not overtly malicious, this weakens informed consent and may surprise users in restricted, privacy-sensitive, or production environments.

Static analysis

No suspicious patterns detected.