Auto Updater

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:48 AM UTC
• Version: 1.0.0

Overview

The skill is clearly an auto-updater, but it creates a recurring task that can automatically change Clawdbot and every installed skill without per-update review.

Install only if you are comfortable with Clawdbot automatically updating itself and every installed skill on a schedule. Prefer a check-only or dry-run workflow, review updates before applying them, and make sure you know how to remove the cron job if behavior changes unexpectedly.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:31
• Finding: Persistent Daily Update Task Executes Across Sessions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:31-39` **Vulnerability Type**: Persistent scheduled task **Risk Level**: High ### Vulnerable Code ```bash clawdbot cron add \ --name "Daily Auto-Update" \ --cron "0 4 * * *" \ --tz "America/Los_Angeles" \ --session isolated \ --wake now \ --deliver \ --message "Run daily auto-updates: check for Clawdbot updates and update all skills. Report what was updated." ``` ### Technical Analysis The Skill instructs the Agent to create a daily scheduled task that survives the setup session. The task wakes an isolated Agent session and requests updates to Clawdbot and every installed Skill. This creates persistent system behavior rather than performing a one-time, user-approved operation. Because the scheduled message initiates software modification automatically, future changes can be installed without contemporaneous review or confirmation. ### Attack Path 1. A user asks the Agent to configure automatic updates. 2. The Agent executes the documented `clawdbot cron add` command. 3. A persistent daily cron entry is registered. 4. At the configured time, the task wakes a new isolated session. 5. The session performs core and Skill update operations without additional user confirmation. 6. The task continues executing across future sessions until explicitly removed. ### Impact Assessment The task obtains the permissions available to the Clawdbot Gateway or cron execution account. Depending on the installation, this can include write access to the Clawdbot installation, installed Skills, configuration, scripts, and globally installed packages. The persistence affects all future scheduled runs and creates a recurring execution path through which compromised upstream updates could modify the Agent environment. No direct privilege escalation beyond the scheduler account is demonstrated. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Require explicit, informed user confirmation immediately before creating any recurring task. - Default to a notification-only or `--dry-run` workflow rather than unattended installation. - Display the exact schedule, commands, execution identity, and affected directories before registration. - Require separate approval before each core or Skill update is applied. - Limit the scheduled task to checking for available updates and delivering a report. - Run the task with a dedicated least-privilege account that cannot modify unrelated system files. - Document and verify removal using: ```bash clawdbot cron remove "Daily Auto-Update" clawdbot cron list ``` - Maintain an audit log of task creation, modification, execution, and removal. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/agent-guide.md:39
• Finding: Unattended Retrieval and Installation of Mutable Remote Software<![CDATA[ ## Vulnerability Details **File Location**: `references/agent-guide.md:39-64` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash # Update Clawdbot log "Updating Clawdbot..." if command -v npm &> /dev/null && npm list -g clawdbot &> /dev/null; then npm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v pnpm &> /dev/null && pnpm list -g clawdbot &> /dev/null; then pnpm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v bun &> /dev/null; then bun update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" else log "Running clawdbot update (source install)" clawdbot update 2>&1 | tee -a "$LOG_FILE" || true fi # Run doctor for migrations log "Running doctor..." clawdbot doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true ``` ### Technical Analysis The update routine resolves and installs mutable remote artifacts through `clawdbot@latest`, `clawdbot update`, and `clawdhub update --all`. It does not pin approved versions, verify cryptographic signatures or checksums, constrain updates to an allowlist, inspect package changes, or require user approval before installation. Package updates can execute installation hooks or replace files that will later be loaded by the Agent. Updating every installed Skill further expands the supply-chain attack surface because the effective code executed after review can change whenever an upstream publisher releases a new version. ### Attack Path 1. An attacker compromises an upstream publisher account, package registry entry, Skill release, or update distribution channel. 2. The attacker publishes a modified version under the expected package or Skill identity. 3. The scheduled updater resolves `@latest` or detects the new Sk ...[truncated 881 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace mutable `@latest` resolution with explicitly approved, pinned versions. - Use a check-only stage to identify available updates without installing them. - Present package provenance, version changes, release notes, and file diffs to the user. - Require explicit confirmation before downloading or applying each update. - Verify registry signatures, publisher identity, and cryptographic checksums before installation. - Restrict Skill updates to a trusted allowlist rather than using unconditional `--all`. - Use a lockfile or signed update manifest where supported. - Stage updates in a sandbox and run security checks before promoting them to the live installation. - Disable or tightly constrain package lifecycle scripts where practical. - Preserve known-good versions and provide an atomic rollback mechanism. - Execute updates under a least-privilege account with narrowly scoped write permissions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/agent-guide.md:49
• Finding: Update and Migration Failures Are Suppressed<![CDATA[ ## Vulnerability Details **File Location**: `references/agent-guide.md:49-64` **Vulnerability Type**: Unsafe error handling in an update routine **Risk Level**: Medium ### Vulnerable Code ```bash else log "Running clawdbot update (source install)" clawdbot update 2>&1 | tee -a "$LOG_FILE" || true fi # Run doctor for migrations log "Running doctor..." clawdbot doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true ``` ### Technical Analysis Although the helper script enables `set -e`, critical update, migration, and Skill-update failures are explicitly neutralized using `|| true`. As a result, the routine proceeds after a failed or partially completed operation. Continuing after a failed core update or migration can combine incompatible program files, configuration schemas, and Skill versions. The final summary path can still be reached, making it harder for downstream automation or users to distinguish complete success from a partially failed update. ### Attack Path 1. A core update fails or is interrupted after modifying part of the installation. 2. The `|| true` construct converts the failure into a successful shell status. 3. `clawdbot doctor --yes` or subsequent Skill updates continue against the inconsistent installation. 4. Additional files or schemas may be modified despite the failed prerequisite. 5. The script reaches its summary output without returning a failure status for the suppressed command. 6. The environment remains partially updated and may fail unpredictably during later Agent sessions. An attacker who can disrupt update delivery could increase the likelihood of this condition, but exploitation does not require a malicious actor; ordinary network, disk, permission, or package failures can trigger it. ### Impact Assessment T ...[truncated 452 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `|| true` from critical update and migration commands. - Capture and preserve the exit status of every pipeline, including commands passed through `tee`. - Enable robust shell behavior: ```bash set -euo pipefail ``` - Stop immediately when a prerequisite update or migration fails. - Report each stage as successful only after validating its exit status and resulting version. - Perform updates atomically or in a staging directory before replacing the active installation. - Back up configuration, package metadata, and migration state before applying changes. - Automatically roll back to the known-good version when validation fails. - Return a nonzero status for partial or complete failure so schedulers and monitoring systems can detect it. - Ensure the user-facing summary prominently identifies failed, skipped, and rolled-back operations. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Self-Modification

High

• Category: Rogue Agent

Content

# Capture new version
CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown")

# Update skills
log "Updating skills via ClawdHub..."
SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true
echo "$SKILL_OUTPUT" >> "$LOG_FILE"

• Confidence: 98% confidence
• Finding: The skill instructs the agent to run `clawdhub update --all`, which self-modifies the agent's installed capabilities by replacing or changing skill code from an external source. This is a high-risk pattern because it can silently expand or alter future agent behavior, and when combined with automation it creates a persistent supply-chain execution path for unreviewed code.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The description emphasizes convenience but does not prominently warn that the skill will automatically modify installed software and skills on a recurring schedule. This reduces informed consent and can lead users to enable unattended updates without understanding the persistence, change scope, or risks from updating third-party components automatically.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The setup phrase is broad and action-oriented, allowing a casual or ambiguous user request to trigger creation of a persistent cron job that performs privileged software modifications. Because the skill installs unattended updates for both the main tool and all skills, an overly permissive trigger increases the chance of unintended activation and surprise execution.

Session Persistence

Medium

• Category: Rogue Agent

Content

bun pm ls -g 2>/dev/null | grep clawdbot && echo "bun-global"
```

## Step 2: Create the Update Script (Optional)

For complex setups, create a helper script at `~/.clawdbot/scripts/auto-update.sh`:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions include `clawdbot doctor --yes` in an automated workflow, explicitly suppressing interactive confirmation for a command that may perform migrations or other state-changing repairs. Running this non-interactively in a scheduled update increases the risk of unintended data, configuration, or environment modifications that the user never reviewed.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide sets up unattended recurring updates for the core bot and all installed skills, which causes ongoing code changes from external sources without an explicit user-facing warning about supply-chain risk, compatibility breakage, or broader system impact. In this context, the danger is amplified because the cron job is configured to run automatically and deliver results after the fact, so new code may be installed before the user can review or approve it.

Static analysis

No suspicious patterns detected.