Security audit
Security checks for vulnerabilities and agentic risk
This skill is an updater that does what it says, but it can schedule recurring bulk updates to installed skills without clearly requiring a preview or user confirmation first.
Install only if you want this skill to help maintain installed skills. Before enabling any scheduled update task, prefer a dry-run or notification-only workflow, and require explicit approval before applying `clawhub update --all`, because it can change multiple installed skills and agent behavior at once.
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Recommended next step:
clawhub update skill-b laterThe skill explicitly instructs applying clawhub update --all, which can modify the local environment and installed skills in bulk without requiring an explicit confirmation or warning about side effects. In an agent-driven workflow, this increases the chance of unintended changes, compatibility regressions, or disruption if the action is executed automatically rather than proposed first.
The guide instructs the agent to run clawhub update --all, which performs state-changing bulk updates, without requiring an explicit warning, confirmation, or dry-run-first step at the moment of execution. In an agent setting, this can cause unintended changes across multiple installed skills, increasing the risk of disruption, incompatible updates, or user surprise if the user asked only for information or loosely phrased maintenance help.
No suspicious patterns detected.