ClawHub
Back to skill

Security audit

Self Updater

Security checks for vulnerabilities and agentic risk

Overview

This skill openly aims to update OpenClaw core and skills, but it documents unattended self-updating through unsafe PowerShell commands and the referenced updater script is not included in the artifact.

Review this carefully before installing. Only use it in an environment where unattended updates to OpenClaw core and skills are acceptable, avoid the documented ExecutionPolicy Bypass examples, verify the updater script source and integrity, and keep approval and notifications enabled for core or multi-skill updates.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:52
Finding

PowerShell Execution Policy Bypass with an Untrusted Relative Script Path

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:52-58; README.md:21-24
Vulnerability Type: Unsafe PowerShell invocation and relative-path execution
Risk Level: Medium

The documentation recommends launching scripts/self-updater.ps1 with PowerShell execution-policy checks disabled:

SKILL.md:52-58

powershell
# Check for updates
powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1

# Auto-update with smart timing
powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming

# Full automation (for cron)
powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming -AutoApprove -Quiet

README.md:21-24

powershell
# Check for updates
powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1

# Auto-update with smart timing
powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming

Technical Analysis

The -ExecutionPolicy Bypass option disables PowerShell execution-policy enforcement for the new process. It therefore suppresses a defense that could otherwise warn about or prevent execution of unsigned or untrusted scripts.

The script is also identified through the relative path scripts/self-updater.ps1. PowerShell resolves that path relative to the process's current working directory, not necessarily relative to the trusted installation directory of the skill. Consequently, the command does not establish that the selected file is the intended updater script.

Combining execution-policy bypass with an unverified relative path creates a local arbitrary-code execution opportunity when an attacker can create or replace the referenced file in the working directory. The unattended command additionally uses -AutoApprove -Quiet, reducing user interaction and visibility during execution.

The audited artifact contains only README.md and SKILL.md; the referen ...[truncated 1911 chars]

Remediation
View remediation

Remediation Suggestions

  1. Package scripts/self-updater.ps1 with the skill so that users do not have to obtain or create it separately.
  2. Remove -ExecutionPolicy Bypass from all documented commands. Use an appropriately signed script and a controlled execution policy instead.
  3. Resolve the script from the trusted skill installation directory rather than the caller's current working directory. Use a canonical absolute path derived from a trusted installation root.
  4. Before execution, verify the script's Authenticode signature or compare its cryptographic digest against a trusted, version-specific manifest.
  5. Reject execution if the resolved script is outside the expected installation directory, is a symbolic link or reparse point to an unexpected location, or has insecure write permissions.
  6. Avoid combining unattended approval and quiet operation for update code unless integrity verification has succeeded. Record the resolved script path, version, signer, and verification result in an audit log.
  7. Correct the repository placeholder in README.md and provide a single authoritative source for installation artifacts.
  8. Add automated release checks that fail packaging when documented runtime files are absent or when documentation contains execution-policy bypass commands.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (20)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · README.md (reported line 1)May include surrounding context.

md
# OpenClaw Self-Updater

[⭐ GitHub](https://github.com/GhostDragon124/openclaw-self-updater) | [📦 ClawHub](https://clawhub.ai/self-updater)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

The README instructs users to run PowerShell with -ExecutionPolicy Bypass, which weakens a Windows protection layer and normalizes bypassing local script execution safeguards. Even though this is documentation, it encourages an unsafe execution pattern for an updater script that likely changes software state and could execute untrusted or tampered code if the update path is compromised.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

powershell
# Check for updates
powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1

# Auto-update with smart timing
powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

This line again recommends running the updater script with -ExecutionPolicy Bypass, now in automatic update mode, which increases risk because it combines policy bypass with unattended state-changing behavior. In the context of a self-updater skill, this is more dangerous because automatic updates can propagate malicious or broken changes without normal execution-policy friction.

Content

Scanner excerpt · README.md (reported line 25)May include surrounding context.

powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1

Auto-update with smart timing

powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming

text

## Install

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md
---
name: self-updater
version: 1.4.2
description: |
  ⭐ OPEN SOURCE! GitHub: github.com/GhostDragon124/openclaw-self-updater

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · README.md (reported line 32)May include surrounding context.

md
---
name: self-updater
version: 1.4.2
description: |
  ⭐ OPEN SOURCE! GitHub: github.com/GhostDragon124/openclaw-self-updater

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

md
---
name: self-updater
version: 1.4.2
description: |
  ⭐ OPEN SOURCE! GitHub: github.com/GhostDragon124/openclaw-self-updater

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 2)May include surrounding context.

md
---
name: self-updater
version: 1.4.2
description: |
  ⭐ OPEN SOURCE! GitHub: github.com/GhostDragon124/openclaw-self-updater

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
---
name: self-updater
version: 1.4.2
description: |
  ⭐ OPEN SOURCE! GitHub: github.com/GhostDragon124/openclaw-self-updater

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
---
name: self-updater
version: 1.4.2
description: |
  ⭐ OPEN SOURCE! GitHub: github.com/GhostDragon124/openclaw-self-updater

Self-Modification

High
Category
Rogue Agent
Confidence
97% confidence
Finding

The description states that the skill auto-updates OpenClaw core and skills, which is direct documentation of self-modifying behavior. Because it targets both the core platform and installed skills, compromise or misuse could alter the agent runtime broadly and persistently.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
name: self-updater
version: 1.4.2
description: |
  ⭐ OPEN SOURCE! GitHub: github.com/GhostDragon124/openclaw-self-updater
  ⭐ ONLY skill with Cron-aware + Idle detection! Auto-updates OpenClaw core & skills, analyzes cron schedules to avoid user tasks, waits for idle time, AI-powered risk assessment, user approval for high-risk updates, and smart notifications.
  Use for: auto-update, maintenance, cron, smart-schedule, skills, gateway, restart, healthcheck, monitoring, ops
repository:

Self-Modification

High
Category
Rogue Agent
Confidence
95% confidence
Finding

The quick-start command instructs execution of the updater script with PowerShell ExecutionPolicy Bypass, indicating a path to running code that changes the installation. Combining self-update functionality with policy-bypass execution increases the blast radius of mistakes or malicious update content.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

powershell
# Check for updates
powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1

# Auto-update with smart timing
powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming

Self-Modification

High
Category
Rogue Agent
Confidence
96% confidence
Finding

The auto-update example documents direct modification of the OpenClaw installation with smart timing but without mandatory human review. This is dangerous in context because the skill updates core and skills and may restart the gateway, making operational disruption or malicious persistence more likely.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1

# Auto-update with smart timing
powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming

# Full automation (for cron)
powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming -AutoApprove -Quiet

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

This example combines self-update, unattended approval bypass, and quiet mode into a silent automation path for modifying the core platform and skills. In context, that is the most dangerous documented flow because it can apply persistent code changes and restarts with minimal oversight or visibility, making supply-chain compromise or operational failure harder to detect in time.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming

Full automation (for cron)

powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming -AutoApprove -Quiet

text

## AI Risk Assessment

Self-Modification

High
Category
Rogue Agent
Confidence
96% confidence
Finding

A parameter explicitly dedicated to updating skills confirms that the skill can modify installed code, which is a self-modification capability. Self-modifying behavior is intrinsically high risk because it can change the agent's future behavior, introduce malicious code from dependencies, or break existing workflows.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
| SmartTiming | false | Wait for idle + check cron |
| AutoApprove | false | Skip approval (for cron) |
| NoNotify | false | Skip notifications |
| UpdateSkillsOnly | false | Update skills only |
| Port | auto | Gateway port |
| IdleThreshold | 5 | Minutes of idle to wait |
| CronLookAhead | 60 | Minutes to look ahead for tasks |

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill advertises very broad trigger terms such as maintenance, skills, gateway, healthcheck, monitoring, and ops, which can cause the agent to invoke an updater in contexts unrelated to explicit update intent. Because this skill performs self-update and restart actions, unintended invocation increases the chance of unplanned system modification or service disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation explicitly promotes unattended execution with '-AutoApprove -Quiet' for cron, which normalizes automatic updates and restarts without emphasizing the operational risk. In a self-updating skill, this can lead to silent software changes, broken compatibility, or downtime occurring without contemporaneous user awareness.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The example command combines AutoUpdate, SmartTiming, AutoApprove, and Quiet into a fully unattended flow, effectively delegating update decisions to the skill. That creates a realistic path to silent and unsupervised state changes, including possible restart-related disruption, if the skill is invoked by scheduler or another agent workflow.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming

Full automation (for cron)

powershell -ExecutionPolicy Bypass -File scripts/self-updater.ps1 -AutoUpdate -SmartTiming -AutoApprove -Quiet

text

## AI Risk Assessment

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
87% confidence
Finding

The statement 'Use -AutoApprove for unattended runs' encourages bypassing the human approval control that the skill otherwise presents as a safety feature. In context, that undermines the main barrier preventing risky or disruptive updates from being applied automatically.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md
3. If approved → proceeds with update
4. If rejected/skipped → cancels gracefully

Use `-AutoApprove` for unattended runs.

## Smart Notifications

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

Documenting 'Skip approval (for cron)' as a normal parameterized behavior enables autonomous decision-making for a self-modifying skill. Even if intended for operations convenience, it reduces human oversight for software changes and can amplify damage from misconfiguration or compromised update sources.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md
|-----------|---------|-------------|
| AutoUpdate | false | Apply updates automatically |
| SmartTiming | false | Wait for idle + check cron |
| AutoApprove | false | Skip approval (for cron) |
| NoNotify | false | Skip notifications |
| UpdateSkillsOnly | false | Update skills only |
| Port | auto | Gateway port |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

Documenting 'Skip approval (for cron)' as a normal parameterized behavior enables autonomous decision-making for a self-modifying skill. Even if intended for operations convenience, it reduces human oversight for software changes and can amplify damage from misconfiguration or compromised update sources.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md
|-----------|---------|-------------|
| AutoUpdate | false | Apply updates automatically |
| SmartTiming | false | Wait for idle + check cron |
| AutoApprove | false | Skip approval (for cron) |
| NoNotify | false | Skip notifications |
| UpdateSkillsOnly | false | Update skills only |
| Port | auto | Gateway port |

Static analysis

No suspicious patterns detected.