Security audit

Auto Updater Gateway

Security checks for vulnerabilities and agentic risk

Overview

This skill openly sets up daily auto-updates, but it can keep changing all installed skills and send version reports to external chat services without a review step.

Install only if you intentionally want unattended daily updates for all ClawHub skills. Prefer pinning or allowlisting trusted skills, review updates before rollout where possible, keep rollback instructions handy, and send reports only to private approved Feishu or Telegram recipients.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README explicitly instructs users to schedule unattended `npx clawhub update --all`, which will modify all installed skills on a recurring basis without any review or approval gate. In a skill ecosystem, bulk automatic updates expand the supply-chain attack surface: a compromised or malicious upstream skill update would be installed automatically and executed in future sessions, making this materially risky rather than merely a documentation omission.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The README promotes sending update reports to Feishu/Telegram but does not warn that package names, version deltas, and operational timing will be disclosed to third-party messaging platforms. While the sample report is not obviously secret, installed skill inventory and update cadence can reveal internal tooling and attack surface, and external delivery increases exposure if channels are misconfigured or accessible by unintended parties.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly instructs users to run unattended daily updates of all installed skills, but it does not warn that automatic dependency or skill changes can introduce breaking behavior, malicious upstream updates, or operational regressions without human review. In this context, the danger comes from automating a privileged package-management action on a schedule, which increases the blast radius of any bad update.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill tells users to send update summaries to Feishu or Telegram, and those summaries include installed-skill names and version comparisons. That exposes internal tooling inventory and patch state to third-party messaging platforms without any warning about confidentiality, retention, or access-control implications.

Static analysis

No suspicious patterns detected.