Auto Updater Gateway

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:14 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims, but it sets up an unattended daily job that can update all installed skills and send version reports externally, so users should review it before installing.

Install only if you are comfortable with a daily unattended job updating every installed ClawHub skill and sending skill/version summaries to the configured messaging recipient. Prefer a pinned, vetted ClawHub CLI, an allowlist of approved skills, manual approval before applying updates, and a reporting destination approved for your environment.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:22

Finding

Persistent Daily Scheduled Task for Automated Skill Updates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:22-30
Additional Location: README.md:20-27
Vulnerability Type: Persistent scheduled-task installation
Risk Level: Critical

Relevant Code Snippet:

bash

openclaw cron add \
  --name "Daily auto-update (ClawHub skills)" \
  --cron "0 4 * * *" \
  --tz "Asia/Shanghai" \
  --session isolated \
  --wake now \
  --deliver \
  --channel feishu \
  --to "ou_xxxxxxxxxxxx" \

Technical Analysis

The Skill instructs the user to create an OpenClaw Gateway cron job that persists beyond the current Skill invocation and runs every day. The --cron "0 4 * * *" argument establishes recurring execution, while --wake now grants the scheduled workflow wake capability. The isolated session limits contamination of the main session but does not eliminate persistence or the permissions available to the scheduled agent.

The scheduled workflow is instructed to update all installed ClawHub skills. Consequently, future upstream changes can enter the environment automatically without an interactive approval decision for each update. The documentation discloses the scheduling behavior, but it still creates a durable cross-session execution mechanism.

Attack Path

1. A user follows the documented setup procedure.
2. openclaw cron add creates a persistent daily scheduled job.
3. OpenClaw wakes an isolated agent session at the configured time.
4. The agent executes the bulk Skill-update workflow using the permissions of the OpenClaw or cron account.
5. If a future Skill release or associated publisher account is compromised, the scheduled workflow retrieves and activates the changed Skill content.
6. The recurring task remains available for subsequent runs until the user explicitly disables or removes it.

Impact Assessment

The scheduled task obtains recurring execution under the privileges assigned to the OpenClaw Gateway account and its ...[truncated 570 chars]

Remediation

View remediation

Remediation Suggestions

• Do not create the scheduled task automatically. Present the exact proposed schedule and require explicit, informed user approval before installation.
• Prefer manual update checks or a notification-only scheduled job that reports available versions without installing them.
• Require separate interactive approval before applying each update or approved update batch.
• Run the updater under a dedicated least-privilege account with a restricted filesystem, network policy, environment, and tool allowlist.
• Limit updates to an explicit allowlist of trusted skills rather than all installed skills.
• Record creation, modification, execution, and removal of the scheduled task in an auditable log.
• Provide an expiration date or bounded run count and automatically remove the task when it is no longer required.
• Verify that only the intended administrator can modify the cron job, its prompts, and its delivery configuration.
• Document and verify a removal procedure using openclaw cron disable and openclaw cron rm.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:42

Finding

Unpinned CLI Execution and Unattended Bulk Skill Updates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:42-53
Additional Locations: SKILL.md:16-17, README.md:15, README.md:35-41
Vulnerability Type: Unpinned package execution and unsafe supply-chain update process
Risk Level: High

Relevant Code Snippet:

bash

npx clawhub list

bash

npx clawhub update --all

The installation instructions also use an unpinned package reference:

bash

npx clawhub install auto-updater-gateway

Technical Analysis

The npx clawhub invocations do not specify an exact CLI version or cryptographic integrity value. Depending on local installation and package-manager resolution behavior, npx may resolve and execute package content that was not independently reviewed or pinned by the user.

The update --all operation broadens the trust boundary further by applying available updates across every installed ClawHub skill. The project does not specify an allowlist, exact target versions, signature verification, checksum validation, publisher verification, staging process, or review gate before activation.

No malicious dependency is included directly in package.json, and no compromise of ClawHub or a Skill publisher was established during this audit. The vulnerability is the unsafe trust and update model, which would allow a future supply-chain compromise to propagate automatically.

Attack Path

1. An attacker compromises a trusted Skill publisher, registry account, distribution channel, or relevant upstream release process.
2. The attacker publishes a modified Skill release or causes an untrusted CLI package version to be resolved.
3. The daily workflow invokes the unpinned npx clawhub command.
4. npx clawhub update --all retrieves and installs the available compromised release without per-Skill approval.
5. The modified Skill becomes available to future OpenClaw sessions.
6. When that Skill is loaded or invoked, its changed ...[truncated 763 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the ClawHub CLI to an exact reviewed version rather than invoking an unconstrained package name through npx.
• Verify package integrity with trusted signatures, hashes, provenance attestations, or an equivalent registry verification mechanism.
• Pin each Skill to an approved version and avoid unattended --all updates.
• Retrieve update metadata first, display the publisher, source, version, checksum, permissions, and change summary, and require approval before installation.
• Maintain an explicit allowlist of Skill identifiers and trusted publishers.
• Stage updates in a sandbox with restricted tools, filesystem access, credentials, and network connectivity.
• Run automated static analysis and behavioral tests against each candidate release before activation.
• Preserve the last known-good versions and provide an atomic rollback process.
• Alert administrators when package ownership, signing keys, source repositories, requested permissions, or integrity metadata change unexpectedly.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (18)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md

- **Timezone field:** Use IANA timezone (e.g., `Asia/Shanghai`)
- **Delivery:** Prefer explicit channel + to so the job always reaches you
- **Clawdbot self-update:** NOT included (skills only)
- **First run:** Test manually before scheduling

---

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

md

- `SKILL.md` — This file

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README promotes scheduled bulk updates of all skills plus notification delivery, but it does not prominently warn users that this will automatically modify installed components on a recurring basis. In this context, unattended bulk updates materially increase the blast radius of any malicious, compromised, or simply incompatible skill release.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

This cron example schedules recurring execution of npx clawhub update --all without pinning the package/tool version, creating an ongoing supply-chain exposure. If the upstream package is compromised or behavior changes, the scheduled job can repeatedly pull and execute unreviewed code and modify installed skills automatically.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

The documented behavior explicitly runs npx clawhub update --all, again without a pinned version, reinforcing a pattern of unreviewed remote code retrieval and execution. In the context of an auto-updater skill, this increases risk because the command modifies the local skill set and could propagate malicious or breaking updates broadly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs use of npx clawhub without a pinned package version, which means each scheduled run may fetch and execute whatever version is currently published. In an auto-update workflow, this creates a supply-chain risk where a compromised or malicious upstream package could gain code execution on every cron run.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly recommends sending update summaries to Feishu/Telegram but does not warn that installed-skill inventory and version data will be transmitted to an external service. That metadata can reveal the user's tooling, integrations, and patch posture, which may aid reconnaissance or violate internal data-handling requirements.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The prerequisite step tells users to install npx clawhub without fixing the version, exposing them to execution of an unreviewed latest release. Because this skill is specifically about unattended automation, unpinned execution increases the likelihood of silent compromise over time.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The login command uses npx clawhub without pinning, so even the authentication step may execute an unexpected package version. If the package were compromised, credentials or tokens used for ClawHub access could be intercepted or abused.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The workflow captures inventory using an unpinned npx clawhub list, allowing arbitrary upstream changes to affect scheduled execution. Since the command reveals installed skill names and versions, a compromised package could both execute code and exfiltrate environment-specific inventory data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 99% confidence

Finding

The core update step runs npx clawhub update --all without version pinning, combining automatic code retrieval with automatic installation of all available updates. This creates a strong supply-chain attack path because a compromised CLI or malicious update channel could change many installed skills in one unattended run.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The post-update inventory command again invokes an unpinned npx clawhub, so the workflow remains exposed even after the update operation. Repeated dynamic resolution across the same job increases the attack surface and makes results less reproducible.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The management/troubleshooting guidance continues to use unpinned npx clawhub, reinforcing unsafe operator behavior beyond the scheduled workflow itself. This broadens the supply-chain risk to manual maintenance actions performed by administrators.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The troubleshooting section instructs npx clawhub login without pinning, which could expose credentials if an unexpected package version executes during remediation. While manual use is less dangerous than unattended cron, it still presents a real supply-chain and credential-handling risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The final troubleshooting guidance references npx clawhub whoami without pinning, again normalizing dynamic execution of the latest package. Although lower impact than the update step, it still permits unreviewed code execution in an administrative context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The example configuration fixes the timezone to Asia/Shanghai and uses Chinese message text, which imposes a specific locale in user-facing operation. The file does not indicate that this is merely an example to customize, nor does it offer an opt-in or alternative locale guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file includes user-facing message text and example outputs in Chinese, but does not state that the skill is China/Chinese-specific or provide an opt-in or configurable language option. That can constitute a natural-language policy issue because it effectively fixes the reporting language for users without explicit choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.