Post Update Maintenance

• Outcome: Pass
• Latest audit: May 26, 2026, 9:15 PM
• Version:
  0.1.0

Overview

This is a disclosed OpenClaw maintenance skill that can change local plugin/config state only when explicitly applied, with backups and rollback behavior.

Install this only if you want an agent to perform OpenClaw maintenance that can update plugins, edit openclaw.json, and restart the gateway. Review dry-run output first, use --apply only in an attended maintenance window, and make sure post-update-awareness is installed from a trusted source.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The library dynamically sources a shell script from several user-writable or profile-dependent filesystem locations and then calls a function defined by that sourced code. In shell, sourcing executes the target file in the current process, so any attacker who can place or modify one of those resolve.sh files gains code execution whenever this helper runs. The skill context increases risk because this is a maintenance skill expected to interact with configs and restart services, so inherited code execution can directly tamper with the OpenClaw environment.

VirusTotal

65/65 vendors flagged this skill as clean.