Post Update Awareness

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:50 AM UTC
• Version: 0.4.0

Overview

This skill is a coherent post-update notification helper that reads OpenClaw version and changelog information, runs limited diagnostics, and avoids changing plugins or configuration.

Installers should be comfortable with this skill running after OpenClaw updates, reading local OpenClaw version/plugin/channel status, writing a small per-profile state file, and making GitHub requests for release notes when no local changelog is found. It should not update plugins, edit configuration, install dependencies, or restart services; those actions are explicitly left to the user or a separate maintenance skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about post-update awareness through reading a pinned CHANGELOG entry for the installed OpenClaw version and summarizing relevant release changes. The supplied code does something materially different: it queries enabled plugins, skips bundled ones, compares plugin versions to a provided gateway version, and reports version drift. That is a distinct maintenance/advisory function and not a supporting implementation detail of changelog summarization. Therefore the description does not accurately represent the code's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description promises a higher-level update analysis workflow: detect an OpenClaw version change, read the changelog entry corresponding to the installed version, and surface meaningful changes and dependency checks. The supplied code does not do any of that analysis. It performs a narrow helper function: searching for and outputting the filesystem path to a local CHANGELOG.md. While this could support the declared workflow, on its own it materially under-implements the stated purpose and lacks the key behaviors described.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about post-update changelog analysis tied to OpenClaw version bumps. The supplied code is a narrow utility for probing whether a Node module is installed and loadable, likely useful as one supporting step for verifying optional dependencies such as sharp/ffmpeg/node-pty. However, by itself it does not implement the declared primary purpose, triggers, or behavior. This is a material description-behavior mismatch, not merely an internal implementation detail.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about post-update change analysis after an OpenClaw version bump. The supplied code does something materially different: it is a resolver utility that locates the skill's scripts directory by checking known install paths and returns that path if found. While this may be a supporting helper within the same skill, this specific code chunk does not implement the described behavior and instead provides an undeclared filesystem resolution capability tied to check-plugin-drift.sh. Therefore the code chunk's actual behavior does not accurately represent the declared purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The scope statement at L023-L027 narrowly limits the skill to reading changelog content, reporting it, and optionally probing native dependencies. Later sections add distinct behaviors: checking plugin versions (L143-L163), querying channel status (L165-L179), and surfacing config rewrite/stale-entry warnings from command output (L181-L196). Those are operational post-update diagnostics beyond the stated "only" scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The skill transmits the installed version to an external service by constructing a GitHub URL with <currentVersion> and fetching remote content at runtime. While low sensitivity in many environments, this creates outbound network dependency, leaks product/version telemetry, and introduces trust in remote content for user-facing summaries; in restricted or internal deployments that can be undesirable or policy-violating.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

2. Remote, pinned to tag:

   bash

   curl -fsSL "https://raw.githubusercontent.com/openclaw/openclaw/v<currentVersion>/CHANGELOG.md"
   

   The v prefix is required. If the remote 404s (e.g. a brand-new release tag hasn't propagated yet), retry once after 30 seconds before giving up.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Querying the GitHub Releases API similarly causes external transmission of environment metadata and relies on third-party content at runtime. This broadens the attack surface through network interception/misconfiguration, rate limiting, or malicious/unexpected release body content being surfaced to users without strong validation.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

3. Fallback (only if both above fail): query the GitHub Releases API for that exact tag:

   bash

   curl -fsSL "https://api.github.com/repos/openclaw/openclaw/releases/tags/v<currentVersion>"
   

   Use the body field as the changelog content.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill says at L289-L293 that it is read-only and "does not mutate state," yet the workflow explicitly requires creating and updating post-update-awareness.json to track versions and retry metadata (L048-L070, L229-L242). Persisting state is a mutation, even if it is limited to the skill's own bookkeeping.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This is an explicit contradiction in the documentation. L289-L293 says the skill does not mutate state in any mode, while earlier sections require writing baseline state on first run and atomically persisting { lastKnownVersion, lastSurfacedAt, profile } plus retry counters/errors (L068, L229-L242).

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.