Security audit

Self Updater

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed updater, but it can silently change OpenClaw core and installed skills, so users should review it before installing.

Install only if you intentionally want a privileged updater that can change OpenClaw and installed skills. Before enabling automation, inspect the actual PowerShell script and update source, avoid AutoApprove or Quiet cron runs unless you have backups and rollback, and use limited-scope notification credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README explicitly advertises automatic updating of both the OpenClaw core and skills, but it does not clearly warn users that updates can change executable behavior, introduce breaking changes, or affect system state and availability. In a self-updating agent context, missing safety disclosure materially increases risk because users may enable automation without understanding the operational and supply-chain implications.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill advertises very broad trigger terms such as maintenance, skills, gateway, restart, healthcheck, monitoring, and ops, which overlap with many normal administrative requests. This increases the chance the updater is invoked in contexts where the user did not explicitly request software modification, making unintended updates or restarts more likely.

Vague Triggers

Low

Confidence: 84% confidence
Finding: The description emphasizes autonomous auto-updating behavior but does not clearly state that updates should only occur after explicit user intent or under tightly defined scheduled automation. In an agent ecosystem, this kind of broad framing can cause over-selection of a self-modifying skill for generic system-health tasks.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: |-----------|---------|-------------| | AutoUpdate | false | Apply updates automatically | | SmartTiming | false | Wait for idle + check cron | | AutoApprove | false | Skip approval (for cron) | | NoNotify | false | Skip notifications | | UpdateSkillsOnly | false | Update skills only | | Port | auto | Gateway port |
Confidence: 95% confidence
Finding: The parameter table exposes AutoApprove as a simple flag to skip approval for cron usage, normalizing fully autonomous updates. Since the skill is designed to update both OpenClaw core and skills, this creates a direct pathway for unattended modification of critical runtime components.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: 3. If approved → proceeds with update 4. If rejected/skipped → cancels gracefully Use `-AutoApprove` for unattended runs. ## Smart Notifications
Confidence: 95% confidence
Finding: The unattended-run guidance for -AutoApprove promotes autonomous execution of updates without real-time user confirmation. In the context of software update and restart functionality, this reduces human oversight at exactly the point where supply-chain, compatibility, or availability risks matter most.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: |-----------|---------|-------------| | AutoUpdate | false | Apply updates automatically | | SmartTiming | false | Wait for idle + check cron | | AutoApprove | false | Skip approval (for cron) | | NoNotify | false | Skip notifications | | UpdateSkillsOnly | false | Update skills only | | Port | auto | Gateway port |
Confidence: 95% confidence
Finding: The parameter table exposes AutoApprove as a simple flag to skip approval for cron usage, normalizing fully autonomous updates. Since the skill is designed to update both OpenClaw core and skills, this creates a direct pathway for unattended modification of critical runtime components.

Self-Modification

High

Category: Rogue Agent
Content: ```powershell # Check for updates powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 # Auto-update with smart timing powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming
Confidence: 91% confidence
Finding: The README instructs users to run a PowerShell script with '-ExecutionPolicy Bypass', which weakens a built-in execution safety control and normalizes running update code with reduced protections. In the context of a self-updater, this increases the chance that unreviewed or tampered scripts can execute and modify the OpenClaw core or installed skills.

Self-Modification

High

Category: Rogue Agent
Content: powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 # Auto-update with smart timing powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming ``` ## Install
Confidence: 93% confidence
Finding: The auto-update example combines automatic updating with 'ExecutionPolicy Bypass', amplifying the risk by encouraging unattended execution of code that can change core components and skills. In a maintenance skill, this context makes the issue more dangerous because it can lead to silent propagation of compromised or breaking updates during idle periods without sufficient user scrutiny.

Self-Modification

High

Category: Rogue Agent
Content: | SmartTiming | false | Wait for idle + check cron | | AutoApprove | false | Skip approval (for cron) | | NoNotify | false | Skip notifications | | UpdateSkillsOnly | false | Update skills only | | Port | auto | Gateway port | | IdleThreshold | 5 | Minutes of idle to wait | | CronLookAhead | 60 | Minutes to look ahead for tasks |
Confidence: 98% confidence
Finding: The skill is explicitly capable of updating installed skills, which is a self-modification pathway for the agent environment. Any mechanism that can replace or alter executable skill content carries high supply-chain and persistence risk if the update source, integrity, or policy boundaries are weak.

Self-Modification

High

Category: Rogue Agent
Content: --- name: self-updater version: 1.4.2 description: | ⭐ OPEN SOURCE! GitHub: github.com/GhostDragon124/openclaw-self-updater
Confidence: 93% confidence
Finding: The skill identity itself indicates self-updating behavior, which is inherently sensitive because it changes the software environment in which the agent operates. Even without malicious intent, self-modification increases the blast radius of configuration mistakes, malicious upstream releases, or accidental downgrade/upgrade issues.

Self-Modification

High

Category: Rogue Agent
Content: name: self-updater version: 1.4.2 description: | ⭐ OPEN SOURCE! GitHub: github.com/GhostDragon124/openclaw-self-updater ⭐ ONLY skill with Cron-aware + Idle detection! Auto-updates OpenClaw core & skills, analyzes cron schedules to avoid user tasks, waits for idle time, AI-powered risk assessment, user approval for high-risk updates, and smart notifications. Use for: auto-update, maintenance, cron, smart-schedule, skills, gateway, restart, healthcheck, monitoring, ops repository:
Confidence: 99% confidence
Finding: The description states that the skill auto-updates both OpenClaw core and skills, which is direct self-modification of the platform and its extensions. This is especially dangerous because it combines autonomous update logic, restart capability, and broad operational scope, creating a high-value supply-chain target.

Self-Modification

High

Category: Rogue Agent
Content: Use for: auto-update, maintenance, cron, smart-schedule, skills, gateway, restart, healthcheck, monitoring, ops repository: type: git url: https://github.com/GhostDragon124/openclaw-self-updater homepage: https://github.com/GhostDragon124/openclaw-self-updater#readme required_binaries: - pwsh (PowerShell 5.1+)
Confidence: 88% confidence
Finding: Linking the skill to an external git repository reinforces that updates likely depend on remote content outside the local trust boundary. For a self-updating skill, remote repository dependence increases the risk of malicious commits, repo compromise, branch drift, or unreviewed changes being pulled into execution.

Self-Modification

High

Category: Rogue Agent
Content: repository: type: git url: https://github.com/GhostDragon124/openclaw-self-updater homepage: https://github.com/GhostDragon124/openclaw-self-updater#readme required_binaries: - pwsh (PowerShell 5.1+) - npm
Confidence: 82% confidence
Finding: The homepage reference further indicates the update mechanism is coupled to an external project source. In a self-modifying context, any externally hosted distribution channel must be treated as part of the attack surface because compromise or redirection could lead to code replacement.

Self-Modification

High

Category: Rogue Agent
Content: ```powershell # Check for updates powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 # Auto-update with smart timing powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming
Confidence: 98% confidence
Finding: The quick-start instructions show direct execution of a self-updater script using PowerShell with ExecutionPolicy Bypass, which lowers local execution safeguards while enabling code that modifies core and skills. This materially increases risk because it encourages users or automation to run privileged update logic with reduced platform protections.

Self-Modification

High

Category: Rogue Agent
Content: powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 # Auto-update with smart timing powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming # Full automation (for cron) powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming -AutoApprove -Quiet
Confidence: 99% confidence
Finding: The auto-update example demonstrates unattended state-changing execution of the self-updater script. Because the script updates core components and skills, this creates a direct pathway for autonomous self-modification that could propagate a bad release or attacker-controlled update without intervention.

Self-Modification

High

Category: Rogue Agent
Content: powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming # Full automation (for cron) powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming -AutoApprove -Quiet ``` ## AI Risk Assessment
Confidence: 100% confidence
Finding: The full automation example combines AutoUpdate, SmartTiming, AutoApprove, and Quiet, resulting in silent unattended self-modification of core and skills. This is the highest-risk configuration because it minimizes visibility, removes approval, and enables persistent environment changes through automation, making exploitation or accidental breakage far harder to detect in time.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.