Auto Updater 1.0.0 (1)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:02 AM UTC
• Version: 1.0.0

Overview

This skill clearly advertises automatic updates, but it creates a persistent daily job that can change Clawdbot and every installed skill without per-update review.

Install only if you intentionally want Clawdbot and every installed skill to update automatically on a schedule. Prefer dry-run or notify-only checks, pin or review versions where possible, avoid running the updater with elevated privileges, and be careful before sending update summaries to third-party messaging providers.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:31

Finding

Persistent Daily Scheduled Task Performs Unattended Updates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-40
Vulnerability Type: T06: System Persistence
Risk Level: High

Complete Code Snippet:

bash

clawdbot cron add \
  --name "Daily Auto-Update" \
  --cron "0 4 * * *" \
  --tz "America/Los_Angeles" \
  --session isolated \
  --wake now \
  --deliver \
  --message "Run daily auto-updates: check for Clawdbot updates and update all skills. Report what was updated."

Technical Analysis

The Skill instructs the Agent to register a recurring cron task. The task survives the setup session, wakes automatically every day, and directs an isolated Agent session to update both Clawdbot and all installed Skills.

This is a persistent system modification rather than a session-scoped operation. The scheduled task subsequently executes update operations without requiring approval for each run. Although this behavior is consistent with the stated purpose of the Skill, it creates an enduring autonomous execution path and expands the impact of any future compromise of the package registry, Skill registry, update tooling, or scheduled-task instructions.

The same persistent setup is also recommended in references/agent-guide.md, lines 72-95.

Attack Path

1. A user asks the Agent to configure automatic updates.
2. The Agent follows the Skill instructions and invokes clawdbot cron add.
3. A persistent job named Daily Auto-Update is registered.
4. At 4:00 AM each day, the platform wakes an isolated Agent session.
5. That session executes core and Skill update commands without separate approval for each package or version.
6. If an update source or published release has been compromised, the scheduled session downloads and installs the affected update.
7. The newly installed component can execute in later sessions under the permissions available to Clawdbot or the relevant package manager.

Impact Assessment

The cron entry prov ...[truncated 583 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed user confirmation immediately before creating the scheduled task.
2. Default to a notification-only job that runs dry-run update checks rather than installing updates.
3. Require separate approval before applying each core or Skill update.
4. Display the exact schedule, timezone, commands, execution identity, and affected components during setup.
5. Restrict the scheduled task to a dedicated least-privileged account with minimal filesystem and tool access.
6. Provide and verify a reliable removal procedure, including confirmation that the cron entry no longer exists.
7. Record an auditable log of each scheduled execution, selected versions, verification results, and failures.
8. Disable automatic execution when provenance or integrity verification fails.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:54

Finding

Unpinned Core and Bulk Skill Updates Create Supply-Chain Exposure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 54-71
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash

# For npm/pnpm/bun installs:
npm update -g clawdbot@latest
# or: pnpm update -g clawdbot@latest
# or: bun update -g clawdbot@latest

# For source installs:
clawdbot update

# Skill updates:
clawdhub update --all

Technical Analysis

The documented update process installs the mutable latest release of the Clawdbot package and performs an unrestricted bulk update of all installed Skills. No version pinning, package allowlist, signature validation, checksum verification, provenance check, staged review, or per-update approval is specified.

Consequently, the effective code installed by this Skill can change after the Skill itself has been audited. The use of @latest delegates version selection to package-registry state, while clawdhub update --all extends the trust boundary to every installed Skill and its latest available release.

The helper script in references/agent-guide.md, lines 37-56, implements the same behavior and suppresses some update failures with || true, allowing later steps to continue even when verification or update operations fail.

Attack Path

1. An attacker compromises a publisher account, registry entry, distribution channel, or upstream release process.
2. The attacker publishes a malicious release that is selected as the latest Clawdbot version or as an update for an installed Skill.
3. The daily scheduled task invokes npm update -g clawdbot@latest, an equivalent package-manager command, or clawdhub update --all.
4. Because versions are not pinned and no independent integrity or provenance check is required, the malicious release is accepted automatically.
5. The package manager or ClawdHub installs the compromised component.
6. The component executes during installation if its distribut ...[truncated 900 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mutable @latest references with explicitly approved, pinned versions.
2. Generate and enforce a lockfile or equivalent version manifest for the core package and installed Skills.
3. Verify cryptographic signatures, checksums, publisher identity, and registry provenance before installation.
4. Use an allowlist of trusted package names, Skill identifiers, publishers, and repositories.
5. Run update checks in dry-run mode and present version changes to the user before installation.
6. Stage updates in an isolated environment and run security and compatibility checks before promotion.
7. Review release diffs and package lifecycle scripts, especially for global package updates.
8. Abort rather than silently continuing when download, integrity, signature, or update checks fail.
9. Preserve a known-good version and provide an authenticated rollback mechanism.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The skill explicitly updates all skills via clawdhub update --all, which is self-modifying behavior affecting the agent's own capabilities and future behavior. In an unattended daily cron workflow, this materially increases the risk of supply-chain compromise, accidental rollout of unsafe skills, or persistence of malicious changes without review.

Content

Scanner excerpt · references/agent-guide.md (reported line 61)May include surrounding context.

md

# Capture new version
CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown")

# Update skills
log "Updating skills via ClawdHub..."
SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true
echo "$SKILL_OUTPUT" >> "$LOG_FILE"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs the user to configure unattended daily updates that modify the Clawdbot installation and all installed skills, but it does not prominently warn that this will cause automatic system and file changes on an ongoing basis. Because updates are applied automatically from external sources, a user may enable it without understanding the persistence and supply-chain risk, making unintended changes or malicious upstream updates more dangerous in this context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide sets up unattended daily updates for the agent and all installed skills, meaning code changes are applied automatically without interactive review. This creates a supply-chain and integrity risk: any malicious, compromised, or simply broken update can be deployed persistently and repeatedly, especially dangerous because the skill updates both the core bot and additional skills.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/agent-guide.md (reported line 21)May include surrounding context.

bun pm ls -g 2>/dev/null | grep clawdbot && echo "bun-global"

text

## Step 2: Create the Update Script (Optional)

For complex setups, create a helper script at `~/.clawdbot/scripts/auto-update.sh`:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The customization guidance includes external-provider delivery without warning that update results may contain sensitive operational details. Sending automated summaries to third-party messaging services can leak software inventory, versions, errors, paths, or environment-specific information, which may aid reconnaissance or violate user expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Recommending sudo as a generic fix for update failures encourages privilege escalation for network-fetched software updates. If users follow that advice, a compromised package source, malicious dependency, or unsafe install script could execute with elevated privileges and cause broader system compromise.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The example cron setup uses --tz "America/Los_Angeles", which imposes a specific locale setting in the primary setup example. The document does not clearly frame this as an opt-in example or prompt the user to choose their own timezone, which can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The guide suggests redirecting delivery to external providers such as Telegram, which expands where update summaries may be sent beyond the stated local user-summary behavior. Those summaries can contain package names, versions, errors, environment details, or other operational metadata, creating an unnecessary data-exposure channel if configured without explicit consent and warning.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The example setup confirmation states that daily updates will run at 4:00 AM in America/Los_Angeles. Under the policy, forcing a locale-specific setting without offering a choice can be a natural-language policy violation, and this line does not indicate that the timezone was selected by the user.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.