T06 · System Persistence
Error
- Location
SKILL.md:27- Finding
Persistent Unattended Update Task Executes Mutable Software Across Sessions
- Content
View full analysis
- Remediation
View remediation
Security audit
Auto Updater Sxdg2
Security checks for vulnerabilities and agentic risk
Overview
This skill is transparent about being an auto-updater, but it creates a persistent unattended job that updates all OpenClaw code and skills and restarts a system service with sudo.
Install only if you intentionally want unattended daily updates for OpenClaw and all installed skills/plugins. Prefer using it to check and notify first, or restrict it with pinned/trusted sources, audit logs, rollback, and a narrowly scoped sudoers rule for exactly the required restart command. Do not grant broad passwordless sudo to the Gateway user.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:112- Finding
Passwordless Privileged Service Restart Recommended for the Gateway Account
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The description presents the skill as routine maintenance but omits that it performs unattended software updates, self/plugin modification, and a privileged service restart. That lack of warning undermines informed consent and can cause users to enable a mechanism that changes code on the system daily with elevated operational impact.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 98% confidence
- Finding
The scheduled task is explicitly instructed to update skills, which is a form of self-/environment modification of agent capabilities. In an unattended recurring context, automatic modification of installed skills increases supply-chain and persistence risks, since future behavior can change without fresh user review.
- Content
--session isolated
--wake now
--deliver
--message "Run daily auto-updates: run 'openclaw update --yes' followed by 'sudo systemctl restart openclaw'. Update skills and report what was updated."text ### Configuration Options
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The command uses shell chaining to execute a privileged restart immediately after an update, creating a tightly coupled execution path with little inspection in between. In a maintenance automation skill, this chaining amplifies risk by turning a single trigger into multiple impactful actions, including activation of newly updated code.
- Content
The primary update command used is:
bash openclaw update --yes && sudo systemctl restart openclawThis updates the core CLI, builds any source checkouts, and updates all installed plugins/skills.
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 97% confidence
- Finding
The skill documents bulk updating all installed skills, enabling broad capability changes across the agent environment in one action. Because skills define agent behavior, unattended mass updates can introduce malicious or incompatible behavior and are particularly risky when coupled with daily automation.
- Content
Skill Updates
Skills are updated as part of the
openclaw updatecommand. To update skills specifically:bash openclaw skills update --all
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs use of sudo to restart a system service as part of an unattended workflow. In context, this normalizes privileged execution for a recurring automation path, increasing the blast radius of any compromised update source, mistaken command, or abuse of the cron-triggered task.
- Content
md 1. Updates OpenClaw itself (via `openclaw update`) 2. Updates all installed skills/plugins 3. Restarts the service via `sudo systemctl restart openclaw` 4. Messages you with a summary of what was updated ## Setup
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The setup phrase is broad and action-oriented, making it easier for an agent to treat a casual user request as consent to install a persistent scheduled task that performs unattended updates and a privileged service restart. In this skill’s context, the phrase can lead directly to creating automation with lasting system effects, so weak trigger constraints increase the chance of unintended execution.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
This cron job payload embeds a privileged restart command in an automated message-driven task, meaning the system is configured to execute privileged maintenance without interactive review. Combining persistence, unattended execution, and sudo materially raises risk if the update path or task instructions are tampered with.
- Content
--session isolated
--wake now
--deliver
--message "Run daily auto-updates: run 'openclaw update --yes' followed by 'sudo systemctl restart openclaw'. Update skills and report what was updated."text ### Configuration Options
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The primary documented command chains a software update directly into a privileged service restart. In this context, a failure or compromise in the update step can immediately be followed by a restart that activates newly changed code, reducing opportunities for review and recovery.
- Content
The primary update command used is:
bash openclaw update --yes && sudo systemctl restart openclawThis updates the core CLI, builds any source checkouts, and updates all installed plugins/skills.
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The troubleshooting guidance recommends passwordless sudo for restarting the service, which weakens host protections around privileged execution. In an auto-update skill, that advice is especially dangerous because it encourages a standing elevation path for a recurring automated process that modifies code.
- Content
md If an update fails, the summary will include the error. Common fixes: - **Permission errors**: Ensure the Gateway user has passwordless sudo for `systemctl restart openclaw`. - **Network errors**: Check internet connectivity - **Package conflicts**: Run `openclaw doctor` to diagnose
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The example configuration fixes
--tztoAmerica/Chicago, which imposes a locale-specific default in the setup flow. The document does not clearly present this as a user-selected example or prompt the user to choose their own timezone before applying it.- Content
Static analysis
No suspicious patterns detected.