Security audit

Auto Updater

Security checks for vulnerabilities and agentic risk

Overview

The skill is clearly an auto-updater, but it creates a recurring task that can automatically change Clawdbot and every installed skill without per-update review.

Install only if you are comfortable with Clawdbot automatically updating itself and every installed skill on a schedule. Prefer a check-only or dry-run workflow, review updates before applying them, and make sure you know how to remove the cron job if behavior changes unexpectedly.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

Location: SKILL.md:31
Finding: Persistent Daily Update Task Executes Across Sessions
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: references/agent-guide.md:39
Finding: Unattended Retrieval and Installation of Mutable Remote Software
Content: View full analysis
/dev/null && npm list -g clawdbot &> /dev/null; then npm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v pnpm &> /dev/null && pnpm list -g clawdbot &> /dev/null; then pnpm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v bun &> /dev/null; then bun update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" else log "Running clawdbot update (source install)" clawdbot update 2>&1 | tee -a "$LOG_FILE" || true fi # Run doctor for migrations log "Running doctor..." clawdbot doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true ``` ### Technical Analysis The update routine resolves and installs mutable remote artifacts through `clawdbot@latest`, `clawdbot update`, and `clawdhub update --all`. It does not pin approved versions, verify cryptographic signatures or checksums, constrain updates to an allowlist, inspect package changes, or require user approval before installation. Package updates can execute installation hooks or replace files that will later be loaded by the Agent. Updating every installed Skill further expands the supply-chain attack surface because the effective code executed after review can change whenever an upstream publisher releases a new version. ### Attack Path 1. An attacker compromises an upstream publisher account, package registry entry, Skill release, or update distribution channel. 2. The attacker publishes a modified version under the expected package or Skill identity. 3. The scheduled updater resolves `@latest` or detects the new Sk ...[truncated 881 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/agent-guide.md:49
Finding: Update and Migration Failures Are Suppressed
Content: View full analysis
&1 | tee -a "$LOG_FILE" || true fi # Run doctor for migrations log "Running doctor..." clawdbot doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true ``` ### Technical Analysis Although the helper script enables `set -e`, critical update, migration, and Skill-update failures are explicitly neutralized using `|| true`. As a result, the routine proceeds after a failed or partially completed operation. Continuing after a failed core update or migration can combine incompatible program files, configuration schemas, and Skill versions. The final summary path can still be reached, making it harder for downstream automation or users to distinguish complete success from a partially failed update. ### Attack Path 1. A core update fails or is interrupted after modifying part of the installation. 2. The `|| true` construct converts the failure into a successful shell status. 3. `clawdbot doctor --yes` or subsequent Skill updates continue against the inconsistent installation. 4. Additional files or schemas may be modified despite the failed prerequisite. 5. The script reaches its summary output without returning a failure status for the suppressed command. 6. The environment remains partially updated and may fail unpredictably during later Agent sessions. An attacker who can disrupt update delivery could increase the likelihood of this condition, but exploitation does not require a malicious actor; ordinary network, disk, permission, or package failures can trigger it. ### Impact Assessment T ...[truncated 452 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Self-Modification

High

Category: Rogue Agent
Confidence: 98% confidence
Finding: The skill instructs the agent to run clawdhub update --all, which self-modifies the agent's installed capabilities by replacing or changing skill code from an external source. This is a high-risk pattern because it can silently expand or alter future agent behavior, and when combined with automation it creates a persistent supply-chain execution path for unreviewed code.
Content: Scanner excerpt · references/agent-guide.md (reported line 61)May include surrounding context.
md
# Capture new version CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true echo "$SKILL_OUTPUT" >> "$LOG_FILE"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description emphasizes convenience but does not prominently warn that the skill will automatically modify installed software and skills on a recurring schedule. This reduces informed consent and can lead users to enable unattended updates without understanding the persistence, change scope, or risks from updating third-party components automatically.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The setup phrase is broad and action-oriented, allowing a casual or ambiguous user request to trigger creation of a persistent cron job that performs privileged software modifications. Because the skill installs unattended updates for both the main tool and all skills, an overly permissive trigger increases the chance of unintended activation and surprise execution.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/agent-guide.md (reported line 21)May include surrounding context.
bun pm ls -g 2>/dev/null | grep clawdbot && echo "bun-global"

text
## Step 2: Create the Update Script (Optional) For complex setups, create a helper script at `~/.clawdbot/scripts/auto-update.sh`:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instructions include clawdbot doctor --yes in an automated workflow, explicitly suppressing interactive confirmation for a command that may perform migrations or other state-changing repairs. Running this non-interactively in a scheduled update increases the risk of unintended data, configuration, or environment modifications that the user never reviewed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide sets up unattended recurring updates for the core bot and all installed skills, which causes ongoing code changes from external sources without an explicit user-facing warning about supply-chain risk, compatibility breakage, or broader system impact. In this context, the danger is amplified because the cron job is configured to run automatically and deliver results after the fact, so new code may be installed before the user can review or approve it.
Content: No source excerpt is available for this finding.