OpenClaw Auto‑Updater (Safe + Scheduled + Summary)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:08 AM UTC
• Version: 1.0.0

Overview

This is a disclosed auto-updater, but it creates unattended recurring jobs that can update OpenClaw and every installed skill without human review.

Install only if you intentionally want unattended OpenClaw maintenance. Prefer the dry-run or core-only mode first, review updates before applying them, avoid `update --all` for untrusted skills, and make sure you know how to list, edit, and remove the scheduled cron job.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:20
• Finding: Recurring unattended update jobs establish cross-session persistence<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20-27`, `SKILL.md:32-39`, `SKILL.md:46-53`, `SKILL.md:58-65`, and `references/agent-guide.md:78-85` **Vulnerability Type**: Scheduled-task persistence **Risk Level**: Critical ### Vulnerable Code ```bash openclaw cron add \ --name "OpenClaw Auto-Update" \ --cron "30 3 * * *" \ --tz "Europe/Berlin" \ --session isolated \ --wake now \ --deliver \ --message "Run daily auto-updates: 1) openclaw update --yes --json 2) clawdhub update --all 3) report versions updated + errors." ``` The implementation guide provides another persistent configuration: ```bash openclaw cron add \ --name "Daily Auto-Update" \ --cron "0 4 * * *" \ --tz "America/Los_Angeles" \ --session isolated \ --wake now \ --deliver \ --message "Run the daily auto-update routine: 1. Check and update OpenClaw (npm/pnpm/bun/global or source). 2. Run openclaw doctor --yes. 3. Update all skills: clawdhub update --all. 4. Report version before/after, updated skills, and any errors." ``` Weekly, dry-run, and core-only variations at the other cited locations use the same persistent scheduling mechanism. ### Technical Analysis The instructions register recurring jobs in OpenClaw's scheduler. These jobs survive the interaction that created them, wake automatically, and start isolated agent sessions without case-by-case authorization. The standard jobs then execute commands that modify OpenClaw and installed Skills. Although scheduled maintenance is the stated purpose of the project, this still creates a persistent autonomous execution mechanism. The use of `--wake now`, unattended `--yes` behavior, and recurring bulk updates increases the consequences of an upstream compromise or an unintended change to the scheduled message. Even the dry-run variation establishes a persistent task, although that variation is not intended to modify packages. ### Attack Path 1. A user or agent follows the documented setup procedu ...[truncated 1150 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not create recurring jobs by default. Offer a one-shot update check as the safe default. 2. Obtain explicit, informed approval immediately before creating any scheduled task. 3. Display the exact schedule, commands, execution identity, update scope, and removal procedure before installation. 4. Separate update discovery from installation: - Schedule read-only update checks. - Present available versions and release information. - Require approval before applying changes. 5. Avoid unattended `--yes`, `--wake now`, and `update --all` behavior. 6. Restrict scheduled tasks to an allowlist of approved components and exact versions. 7. Run the task under a dedicated least-privileged account with narrowly scoped filesystem and network access. 8. Provide and verify disable/removal commands as part of setup. 9. Record scheduler configuration changes in an auditable log and notify the user whenever a persistent task is created or modified. ]]>

T08 · Insecure Dependencies

Error

• Location: references/agent-guide.md:38
• Finding: Mutable latest-version and bulk Skill updates create a supply-chain execution path<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:27`, `SKILL.md:39`, `references/agent-guide.md:38-59`, and `references/agent-guide.md:85` **Vulnerability Type**: Unpinned and unreviewed dependency updates **Risk Level**: High ### Vulnerable Code ```bash # Update OpenClaw log "Updating OpenClaw..." if command -v npm &> /dev/null && npm list -g openclaw &> /dev/null; then npm update -g openclaw@latest 2>&1 | tee -a "$LOG_FILE" elif command -v pnpm &> /dev/null && pnpm list -g openclaw &> /dev/null; then pnpm update -g openclaw@latest 2>&1 | tee -a "$LOG_FILE" elif command -v bun &> /dev/null; then bun update -g openclaw@latest 2>&1 | tee -a "$LOG_FILE" else log "Running openclaw update (source install)" openclaw update 2>&1 | tee -a "$LOG_FILE" || true fi # Run doctor for migrations log "Running doctor..." openclaw doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version OPENCLAW_VERSION_AFTER=$(openclaw --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true ``` The primary setup also schedules the following update sequence: ```bash --message "Run daily auto-updates: 1) openclaw update --yes --json 2) clawdhub update --all 3) report versions updated + errors." ``` ### Technical Analysis The procedure resolves and installs mutable `latest` releases and updates every installed Skill. It does not specify: - Exact approved versions. - Package integrity hashes. - Signature or provenance verification. - A trusted-source policy. - A Skill allowlist. - Human review of release changes before activation. - A staging or rollback process. Consequently, the code and instructions ultimately executed by OpenClaw can change after this Skill has been reviewed. A compromised registry publisher, malicious upstream release, or compromised Skill update could be distributed through the normal update process. This finding does not establish that any ...[truncated 1473 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with exact, reviewed versions. 2. Pin package integrity hashes or lockfile entries where supported. 3. Require cryptographic signature and publisher-provenance verification before installation. 4. Use only explicitly configured and trusted registries. 5. Replace `clawdhub update --all` with an allowlist of approved Skill identifiers and versions. 6. Split the workflow into separate phases: - Discover available updates. - Retrieve metadata and release notes. - Verify signatures and integrity. - Present changes for review. - Install only after explicit authorization. 7. Stage updates in an isolated environment and run compatibility/security checks before production activation. 8. Maintain a known-good rollback package and automatically revert failed validation. 9. Record the source, version, digest, signer, and approval identity for every installed update. 10. Do not expose production credentials or broad filesystem permissions during update validation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/agent-guide.md:46
• Finding: Suppressed update failures can conceal partial or inconsistent installations<![CDATA[ ## Vulnerability Details **File Location**: `references/agent-guide.md:46-59` **Vulnerability Type**: Improper error handling and failure suppression **Risk Level**: Medium ### Vulnerable Code ```bash else log "Running openclaw update (source install)" openclaw update 2>&1 | tee -a "$LOG_FILE" || true fi # Run doctor for migrations log "Running doctor..." openclaw doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version OPENCLAW_VERSION_AFTER=$(openclaw --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true echo "$SKILL_OUTPUT" >> "$LOG_FILE" log "Auto-update complete." ``` ### Technical Analysis The script begins with `set -e`, which ordinarily stops execution after an unhandled failure. However, the core source update, automated doctor operation, and bulk Skill update explicitly append `|| true`. This converts nonzero exit statuses into success and allows execution to continue. As a result: - A failed core update can be followed by migration and Skill updates. - A failed migration can be followed by further operations. - A failed or partial Skill update does not cause the script to fail. - The script logs `Auto-update complete.` even when one or more critical operations failed. Although command output is retained, the authoritative exit status is discarded. A reporting agent may parse the text incorrectly or present completion as success, leaving incompatible or partially updated components undetected. ### Attack Path 1. A network interruption, permission error, repository conflict, malicious upstream response, or package failure causes an update command to return a nonzero status. 2. `|| true` suppresses that status. 3. The script continues to run doctor, migration, version-detection, or Skill-update operations against an uncertain installation state. 4. The script emits `Auto-update complete.` despite the earlier failure. 5. An ope ...[truncated 883 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `|| true` from security-critical update and migration commands. 2. Capture and preserve each command's actual exit status, including pipeline status: ```bash set -euo pipefail ``` 3. Stop dependent operations when a prerequisite fails. For example, do not run migrations or Skill updates after a failed core update. 4. Track explicit states such as `success`, `failed`, `skipped`, and `rolled_back` for each operation. 5. Emit `Auto-update complete.` only if all required operations succeed. 6. Return a nonzero process status whenever any required update or validation step fails. 7. Report partial success separately and include the failed command, exit code, and sanitized diagnostic output. 8. Validate the resulting installation with health and compatibility checks before declaring success. 9. Implement transactional staging or rollback so a failed update does not leave mixed versions active. 10. Alert an operator after failure rather than silently waiting for the next scheduled run. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Self-Modification

High

• Category: Rogue Agent

Content

# Capture new version
OPENCLAW_VERSION_AFTER=$(openclaw --version 2>/dev/null || echo "unknown")

# Update skills
log "Updating skills via ClawHub..."
SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true

• Confidence: 97% confidence
• Finding: The script performs `clawdhub update --all`, which is a self-modification path for agent skills and implicitly trusts all upstream skill sources. In this context, the risk is elevated because the update is intended to run automatically via cron, so any malicious or compromised skill update could be pulled and installed without user intervention.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly schedules unattended update commands that make live changes to both the OpenClaw installation and installed skills, including use of non-interactive approval semantics (`--yes`). That creates a real safety and supply-chain risk because updates can be applied automatically without human review, potentially introducing breaking changes, malicious upstream packages, or service disruption during off-hours.

Session Persistence

Medium

• Category: Rogue Agent

Content

bun pm ls -g 2>/dev/null | grep openclaw && echo "bun-global"
```

## Step 2: Create the Update Script (Optional)

For complex setups, create a helper script at `~/.openclaw/scripts/auto-update.sh`:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide explicitly schedules unattended software updates, runs `openclaw doctor --yes`, and updates all skills without requiring review or approval. This is dangerous because it enables automatic code and configuration changes, including migrations and third-party skill updates, which can introduce breaking changes or execute compromised upstream content without human oversight.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The example states that daily updates will run at 4:00 AM in Europe/Berlin, which imposes a specific locale setting in natural language. Because the file does not indicate that this time zone is user-selected or configurable at setup time, it may violate the policy against forcing a locale without user opt-in.

Static analysis

No suspicious patterns detected.