openclaw-update

• Outcome: Review
• Latest audit: May 28, 2026 · 11:44 AM UTC
• Version: 1.0.1

Overview

This OpenClaw updater appears purpose-built rather than malicious, but it has enough authority to change the agent installation, copy credentials/workspace data, run remote installers, delete/restore state, restart services, and create scheduled background checks without strong safety boundaries.

Install only if you want this skill to manage OpenClaw maintenance, not just answer update questions. Require it to stop after assessment until you explicitly approve backup, install/update, restore, restart, or scheduled-check setup. Avoid curl-to-bash or moving-branch installs unless you independently trust and verify the source. Treat created backups as sensitive because they may contain credentials and workspace data, and enable the daily scheduled check only if you know how to audit and remove it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

dst = backup_path / item
                if src.exists():
                    cmd = f'powershell.exe -Command "Copy-Item -Recurse \'{src}\' \'{dst}\'"'
                    subprocess.run(cmd, shell=True, capture_output=True)
        else:
            # macOS / Linux - 使用 rsync
            rsync_cmd = ['rsync', '-av', '--quiet']

• Confidence: 98% confidence
• Finding: On Windows, the script builds a PowerShell command string and executes it with shell=True. Even though the current paths are usually local filesystem paths, composing a shell command from path values is dangerous because special characters in usernames or directory names can break quoting or enable command injection, leading to arbitrary command execution in the user's context.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""发送通知（使用系统通知）"""
    try:
        # macOS
        subprocess.run([
            "osascript",
            "-e", f'display notification "{message}" with title "{title}"'
        ], check=True)

• Confidence: 94% confidence
• Finding: The script interpolates `message` and `title` directly into AppleScript source passed to `osascript -e`. If either value contains quotes or AppleScript metacharacters sourced from command output or remote content, an attacker could break out of the string literal and inject unintended AppleScript commands on the host.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill performs shell execution, file writes, backup creation, package installation, service restarts, and scheduled task setup, yet declares no explicit permissions or constraints. This creates an authorization gap where a caller may invoke high-impact actions without clear user consent boundaries or sandbox expectations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The description frames the skill as update assessment and execution, but the body also introduces persistence via cron, local notification behavior, report/log writing, and backup enumeration. This mismatch weakens informed consent because users may approve an update check without realizing the skill can install ongoing background tasks and create additional artifacts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README includes manual recovery commands that recursively delete the user's ~/.openclaw directory before restoring a backup, but it does not prominently warn that these commands are destructive and can cause irreversible loss if the backup name is wrong, missing, or incomplete. In a skill specifically designed to automate update and recovery operations, presenting destructive commands as routine recovery steps materially increases the chance of unsafe execution.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The invocation guidance is broad enough to trigger on common requests about checking updates or upgrading OpenClaw, even though the skill contains destructive and persistent capabilities. Overbroad matching increases the chance the agent selects this skill in contexts where the user only wanted information, leading to unintended system modification.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The recovery instructions include destructive deletion of the user's OpenClaw directory using rm -rf / Remove-Item -Force before restore, but the text does not clearly warn about data loss, path verification, or validation of the chosen backup. A mistaken path, malformed timestamp, or wrong backup selection could irreversibly destroy user configuration or other files.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill instructs creation of cron or scheduled tasks that will continue running automatically, access network resources, and write reports/logs, but the warning about ongoing execution and artifact creation is minimal. Persistence changes user expectations and expands the attack surface if the script or its path is later modified.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The restore function copies backup contents into the live .openclaw directory without requiring explicit user confirmation, dry-run output, or conflict checks. In an update-and-recovery skill that handles credentials and workspace data, this can cause unintended data overwrite or rollback to stale state, potentially losing user changes or restoring compromised files.

Self-Modification

High

• Category: Rogue Agent

Content

# OpenClaw Update Skill - ClawHub Release

## 📦 Skill Information

• Confidence: 84% confidence
• Finding: This skill's stated purpose is to assess, update, back up, restore, and restart OpenClaw, which is a form of self-modification of the agent's own runtime/tooling environment. Self-update capabilities are inherently high risk because they can change executable code, configuration, and operational state, and this README also advertises automated update execution and gateway restart.

Self-Modification

High

• Category: Rogue Agent

Content

description: OpenClaw 版本升级评估与执行技能。工作流程：(1) 检测 agent-reach 可用性（无则引导安装），(2) 检查 GitHub releases 获取最新稳定版，(3) 对比当前版本判断是否需要更新，(4) 分析版本差距和更新日志，(5) 检查 GitHub issues 评估风险，(6) 综合评估打分并给出升级建议，(7) 备份用户配置（防止冲突），(8) 检测安装方式执行对应更新命令，(9) 自动重启 gateway，(10) 提供恢复功能。Use when 用户要求检查 OpenClaw 更新、评估是否升级、或执行版本更新。支持中英双语。
---

# OpenClaw Update Skill

## Multilingual Support / 多语言支持

• Confidence: 90% confidence
• Finding: This skill is designed to update OpenClaw itself, which is a self-modifying operation affecting the agent's runtime or managed software. Even when intended for maintenance, self-update is high risk because it changes trusted code, may alter behavior, and can be abused if version sources, install commands, or user consent are not tightly controlled.

Session Persistence

Medium

• Category: Rogue Agent

Content

**macOS / Linux:**
```bash
# Add to crontab
crontab -e

# Add this line (runs at 4:00 AM daily)
0 4 * * * /usr/bin/python3 ~/.openclaw/workspace/skills/openclaw-update/scripts/cron_check.py >> ~/.openclaw/cron_check.log 2>&1

• Confidence: 97% confidence
• Finding: Editing crontab to run a script daily establishes persistence outside the current session. If the script path or dependent files are altered later, the scheduled task can execute unintended code repeatedly with the user's privileges.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Setup Cron Task / 设置 Cron 任务

**After installing this skill, offer to create a cron task for automatic daily checks:**

**Progress message:**
> 🤖 **Setting up automated daily update check...** / **正在设置自动每日更新检查...**

• Confidence: 95% confidence
• Finding: This duplicate finding points to the same automatic daily check language that establishes persistent scheduled execution. The danger is contextual: in an update skill, persistence is not strictly necessary for core operation and therefore should not be bundled as a default behavior.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Progress message:**
> 🤖 **Setting up automated daily update check...** / **正在设置自动每日更新检查...**

**Create cron task that runs at 4:00 AM daily:**

```bash
# Method 1: Using OpenClaw cron (recommended)

• Confidence: 95% confidence
• Finding: The skill explicitly instructs creation of a daily cron task, which is classic session persistence. Persistent schedulers magnify risk because any bug, compromise, or path hijack in the referenced script will be re-triggered automatically.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Setup Cron Task / 设置 Cron 任务

**After installing this skill, offer to create a cron task for automatic daily checks:**

**Progress message:**
> 🤖 **Setting up automated daily update check...** / **正在设置自动每日更新检查...**

• Confidence: 95% confidence
• Finding: This duplicate finding points to the same automatic daily check language that establishes persistent scheduled execution. The danger is contextual: in an update skill, persistence is not strictly necessary for core operation and therefore should not be bundled as a default behavior.

External Script Fetching

High

• Category: Supply Chain

Content

### Official Recommended (Re-run Installer)

```bash
curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard
```

---

• Confidence: 98% confidence
• Finding: The README recommends piping a remotely fetched shell script directly into bash, which creates a classic arbitrary code execution path if the remote server, network path, or DNS is compromised. Because this skill is specifically about updating core software, users may be primed to trust and execute the command without independently inspecting the script.

External Script Fetching

High

• Category: Supply Chain

Content

**Official recommended method (re-run installer):**
```bash
curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard
```

---

• Confidence: 99% confidence
• Finding: The skill recommends piping a remote script directly into bash from https://openclaw.ai/install.sh. This is dangerous because it executes unreviewed network-fetched code immediately; if the server, DNS, TLS trust, or delivery path is compromised, arbitrary code runs on the user's system.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# macOS / Linux
rm -rf ~/.openclaw && cp -r ~/.openclaw.backup.TIMESTAMP ~/.openclaw

# Windows PowerShell
Remove-Item -Recurse -Force $env:USERPROFILE\.openclaw

• Confidence: 97% confidence
• Finding: This duplicated finding points to the same destructive restore example, which combines recursive deletion with overwrite-style restoration. The danger is not just the command itself but the skill context: it normalizes use of high-impact shell commands during maintenance, increasing the chance of accidental or unsafe operator behavior.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# macOS / Linux
rm -rf ~/.openclaw && cp -r ~/.openclaw.backup.TIMESTAMP ~/.openclaw

# Windows PowerShell
Remove-Item -Recurse -Force $env:USERPROFILE\.openclaw

• Confidence: 97% confidence
• Finding: This duplicated finding points to the same destructive restore example, which combines recursive deletion with overwrite-style restoration. The danger is not just the command itself but the skill context: it normalizes use of high-impact shell commands during maintenance, increasing the chance of accidental or unsafe operator behavior.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# macOS / Linux
rm -rf ~/.openclaw && cp -r ~/.openclaw.backup.TIMESTAMP ~/.openclaw

# Windows PowerShell
Remove-Item -Recurse -Force $env:USERPROFILE\.openclaw

• Confidence: 98% confidence
• Finding: This duplicate finding flags the same unsafe deletion-and-restore pattern. Combining forced deletion and copy in one command increases blast radius and leaves little opportunity to detect errors before data is lost.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# macOS / Linux
rm -rf ~/.openclaw && cp -r ~/.openclaw.backup.TIMESTAMP ~/.openclaw

# Windows PowerShell
Remove-Item -Recurse -Force $env:USERPROFILE\.openclaw

• Confidence: 98% confidence
• Finding: This duplicate finding flags the same unsafe deletion-and-restore pattern. Combining forced deletion and copy in one command increases blast radius and leaves little opportunity to detect errors before data is lost.

Static analysis

No suspicious patterns detected.