Security audit

openclaw-update

Security checks for vulnerabilities and agentic risk

Overview

This OpenClaw updater is mostly coherent with its purpose, but it needs Review because it can change the local runtime and recommends unsafe mutable install/update paths plus optional persistent scheduled checks.

Install only if you are comfortable with a system-management skill that can update OpenClaw, restart services, copy credentials/workspace data, and optionally create a scheduled task. Prefer assessment-only use, avoid the curl-to-bash installer and unpinned GitHub dependency unless independently verified, require explicit approval before updates/restores/scheduling, and make a separate trusted backup first.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:286
Finding: Mutable Remote Installer Executed Directly Through a Shell Pipeline
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:34
Finding: Unpinned Third-Party Package Installed from a Mutable GitHub Branch
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Warning

Location: SKILL.md:345
Finding: Optional Daily Scheduled Task Creates Cross-Session Persistence
Content: View full analysis
> ~/.openclaw/cron_check.log 2>&1 ``` ```powershell $action = New-ScheduledTaskAction -Execute "python" -Argument "~/.openclaw/workspace/skills/openclaw-update/scripts/cron_check.py" $trigger = New-ScheduledTaskTrigger -Daily -At 4am Register-ScheduledTask -TaskName "OpenClaw Daily Update Check" -Action $action -Trigger $trigger ``` ### Technical Analysis These instructions establish recurring execution that survives the current Skill invocation and user session. The persistence is disclosed and described as something to offer rather than install silently, which reduces the risk, but a scheduled task is not required for the core on-demand update-assessment functionality. The task executes a script from a user-writable workspace path. If that script or its parent Skill directory is later replaced or modified, the scheduler will execute the replacement automatically. The scheduled script also invokes the externally installed `agent-reach` executable and performs recurring network access. The current `cron_check.py` does not automatically install an update; it checks versions and issues, writes a report, and sends notifications. Therefore, the confirmed concern is recurring code execution and ...[truncated 1089 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/backup_restore.py:29
Finding: Backup Name Generator Fails Before the Protected Backup Operation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (49)

Self-Modification

High

Category: Rogue Agent
Confidence: 93% confidence
Finding: This skill is explicitly designed to modify the installed OpenClaw environment by assessing and executing upgrades, creating backups, and restarting the gateway. Self-modifying behavior in an agent skill is high risk because it changes the runtime and trusted tooling, and when paired with network-sourced version data it can alter the host environment in ways that are hard for users to fully audit.
Content: Scanner excerpt · README.md (reported line 1)May include surrounding context.
md
# OpenClaw Update Skill - ClawHub Release ## 📦 Skill Information

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The README recommends piping a remote shell script directly into bash, which executes network-fetched code without prior inspection or integrity verification. In an update skill context this is especially dangerous because users are primed to trust installation instructions, making compromise of the remote host, TLS interception, or supply-chain tampering immediately code-executable on the system.
Content: Scanner excerpt · README.md (reported line 204)May include surrounding context.
Official Recommended (Re-run Installer)

bash
curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Although narrower than a bare home-directory wipe, rm -rf ~/.openclaw still performs irreversible deletion of state for a live tool and may remove credentials, settings, logs, or user workspace content if assumptions about directory contents are wrong. Because the skill already emphasizes backup/restore, presenting a raw destructive primitive without safeguards materially increases the chance of harmful operator error.
Content: Scanner excerpt · README.md (reported line 233)May include surrounding context.
bash
# macOS / Linux rm -rf ~/.openclaw && cp -r ~/.openclaw.backup.TIMESTAMP ~/.openclaw # Windows PowerShell Remove-Item -Recurse -Force $env:USERPROFILE\.openclaw

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Although narrower than a bare home-directory wipe, rm -rf ~/.openclaw still performs irreversible deletion of state for a live tool and may remove credentials, settings, logs, or user workspace content if assumptions about directory contents are wrong. Because the skill already emphasizes backup/restore, presenting a raw destructive primitive without safeguards materially increases the chance of harmful operator error.
Content: Scanner excerpt · README.md (reported line 233)May include surrounding context.
bash
# macOS / Linux rm -rf ~/.openclaw && cp -r ~/.openclaw.backup.TIMESTAMP ~/.openclaw # Windows PowerShell Remove-Item -Recurse -Force $env:USERPROFILE\.openclaw

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 代码块的实际职责是“备份与恢复工具”，而不是完整的“版本升级评估与执行技能”。声明中的第(7)步“备份用户配置”和第(10)步“恢复功能”与代码相符，但其余核心升级相关能力均未出现。代码只访问本地 ~/.openclaw 目录和用户家目录，使用 subprocess 调用 rsync/PowerShell 进行文件复制；没有任何网络请求、GitHub 交互、版本判断、更新执行或服务重启逻辑。因此描述与该代码块的实际行为存在明显且实质性的目的不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个完整的 OpenClaw 更新评估与执行技能，而提供的代码片段只是其中第(1)步的一小部分：检测 agent-reach 和测试 GitHub 访问。代码的实际主要功能与声明的整体技能目标相比明显更窄，缺少绝大多数核心升级相关能力。因此描述不能准确代表该代码块实际行为，属于明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description promises an end-to-end upgrade evaluation and execution workflow, but the supplied code is only a basic local version checker. Its primary purpose is materially narrower than declared. It invokes the local openclaw --version command, parses the version format, and prints a suggestion to manually use agent-reach for releases. There is no implementation of most of the advertised workflow steps, and no hidden undeclared capability beyond local subprocess execution. Therefore this is a clear description-behavior mismatch due to substantial overstatement of functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个端到端的“评估并执行升级”技能，而代码只是“定时检查并通知”的子功能，主目的明显更窄。代码确实覆盖了部分声明内容：agent-reach 可用性检查、获取最新版本、版本比较、简单 issues 风险检查、输出建议。但声明中的核心后半段能力——备份配置、执行更新、重启 gateway、恢复——完全没有实现。相反，代码引入了定时 cron 场景、系统通知和本地报告落盘，这些触发方式和行为并未在声明中明确体现。虽然这些附加行为与“更新检查”相关，但整体上描述与代码能力范围存在实质性不匹配，因此应判定为 mismatch。
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 97% confidence
Finding: This skill is explicitly designed to update the local OpenClaw installation, which is a form of self-modification of the agent/runtime environment. Self-updating changes the executing codebase and trust boundary; if the source, release selection, or commands are wrong or tampered with, it can lead to arbitrary code execution or destabilize the agent.
Content: Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.
md
description: OpenClaw 版本升级评估与执行技能。工作流程：(1) 检测 agent-reach 可用性（无则引导安装），(2) 检查 GitHub releases 获取最新稳定版，(3) 对比当前版本判断是否需要更新，(4) 分析版本差距和更新日志，(5) 检查 GitHub issues 评估风险，(6) 综合评估打分并给出升级建议，(7) 备份用户配置（防止冲突），(8) 检测安装方式执行对应更新命令，(9) 自动重启 gateway，(10) 提供恢复功能。Use when 用户要求检查 OpenClaw 更新、评估是否升级、或执行版本更新。支持中英双语。 --- # OpenClaw Update Skill ## Multilingual Support / 多语言支持

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: curl -fsSL https://openclaw.ai/install.sh | bash downloads and executes a remote script directly in the shell with no integrity verification, review step, or pinning. If the server, DNS, TLS chain, or distribution path is compromised, this becomes immediate arbitrary code execution on the host.
Content: Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.
Official recommended method (re-run installer):

bash
curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: This is the same underlying issue as the broader matched rm -rf ~ context: the skill documents a forceful recursive delete as part of restore. Even though the intended target is ~/.openclaw, destructive path handling in shell instructions can become catastrophic if expanded incorrectly or modified downstream.
Content: Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.
bash
# macOS / Linux rm -rf ~/.openclaw && cp -r ~/.openclaw.backup.TIMESTAMP ~/.openclaw # Windows PowerShell Remove-Item -Recurse -Force $env:USERPROFILE\.openclaw

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: This is the same underlying issue as the broader matched rm -rf ~ context: the skill documents a forceful recursive delete as part of restore. Even though the intended target is ~/.openclaw, destructive path handling in shell instructions can become catastrophic if expanded incorrectly or modified downstream.
Content: Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.
bash
# macOS / Linux rm -rf ~/.openclaw && cp -r ~/.openclaw.backup.TIMESTAMP ~/.openclaw # Windows PowerShell Remove-Item -Recurse -Force $env:USERPROFILE\.openclaw

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: This is the same underlying issue as the flagged subprocess call: a shell-based PowerShell command is assembled from path values and executed with shell=True. In an update/backup skill that touches credentials and configuration, command execution via path manipulation is especially dangerous because it can lead to arbitrary code execution and compromise of sensitive local data.
Content: Scanner excerpt · scripts/backup_restore.py (reported line 139)May include surrounding context.
python
dst = backup_path / item if src.exists(): cmd = f'powershell.exe -Command "Copy-Item -Recurse \'{src}\' \'{dst}\'"' subprocess.run(cmd, shell=True, capture_output=True) else: # macOS / Linux - 使用 rsync rsync_cmd = ['rsync', '-av', '--quiet']

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The restore flow copies backup contents into the live .openclaw directory without any confirmation, dry-run, conflict detection, or rollback protection. In a tool handling configuration, credentials, and workspace data, an accidental or manipulated restore target can overwrite sensitive user state, destroy current data, or replace trusted configuration with stale or malicious content.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · scripts/check_agent_reach.py (reported line 83)May include surrounding context.
python
if access_ok: print(f"✅ {access_msg}") print("\n✅ 可以正常使用 openclaw-update skill！") return 0 else: print(f"⚠️ {access_msg}")

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · scripts/check_agent_reach.py (reported line 92)May include surrounding context.
python
if access_ok: print(f"✅ {access_msg}") print("\n✅ 可以正常使用 openclaw-update skill！") return 0 else: print(f"⚠️ {access_msg}")

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manual recovery section includes destructive deletion commands that remove the user's active OpenClaw directory before restoration, but it lacks prominent warnings, validation steps, or backup-integrity checks. In a system tool context, users may copy-paste these commands directly, risking accidental data loss if the backup name is wrong, incomplete, or stale.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README expands the skill from an on-demand update assistant into a persistence-capable automation tool by documenting automated daily update checks and system notifications. That broadening of scope increases the chance of unattended actions, surprise network activity, or repeated prompts/updates beyond what a user requested, which is a meaningful security and trust concern for a system-management skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: A daily cron-based update check introduces persistence and autonomous execution into a skill whose stated purpose is interactive upgrade assessment/execution. Even if framed as convenience, scheduled checks can create unbounded recurring behavior, periodic network access, and a pathway to future unattended updates or social-engineered prompts.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill contains numerous shell commands and file-modifying operations, but it declares no explicit tool restrictions or permission scope. That makes it easier for the runtime to grant broader-than-necessary capabilities, increasing the chance of unintended command execution, file writes, deletion, service restarts, and persistence changes.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest says to use the skill when the user asks to check updates, assess whether to upgrade, or perform an update, but it does not define specific trigger phrases, boundaries, or exclusion conditions. Phrases like '评估是否升级' and '执行版本更新' are broad enough to overlap with ordinary support conversations about updates, increasing the chance of unintended invocation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill advertises system-changing actions such as updates, backups, restart, restore, and scheduled-task setup without an upfront warning that these alter local state and services. Users may invoke it expecting analysis only, yet the documented workflow includes commands that can modify software, persistence, and configuration.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.
text
**Critical Rules:** 1. NEVER overwrite existing backups 2. ALWAYS use unique timestamp + random suffix 3. ALWAYS inform user of backup location at the end

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill extends beyond on-demand update checking into automated scheduled monitoring, causing recurring execution after the original session. Persistent automation increases the blast radius of any mistake or compromise and can repeatedly touch network, files, and update paths without fresh review.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 95% confidence
Finding: This is a duplicate persistence finding on the same cron-setup language and should be treated the same way: it introduces unattended recurring behavior. In the context of a tool that can also update and restart services, persistence materially increases operational risk.
Content: Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.
md
### Setup Cron Task / 设置 Cron 任务 **After installing this skill, offer to create a cron task for automatic daily checks:** **Progress message:** > 🤖 **Setting up automated daily update check...** / **正在设置自动每日更新检查...**

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T08 · Insecure Dependencies

T06 · System Persistence

T09 · Insecure Skill Coding Practices

SkillSpector

Self-Modification

External Script Fetching

Official Recommended (Re-run Installer)

Tool Parameter Abuse

Tool Parameter Abuse

Tp4

Tp4

Tp4

Tp4

Self-Modification

External Script Fetching

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Missing User Warnings

Self-Modification

Self-Modification

Missing User Warnings

Description-Behavior Mismatch

Context-Inappropriate Capability

Undeclared Tool Scope

Vague Triggers

Missing User Warnings

Session Persistence

Context-Inappropriate Capability

Session Persistence