ClawHub
Back to skill

Security audit

Auto Updater.Bak

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently sets up automatic updates, but it needs Review because it creates a persistent daily job that changes Clawdbot and every installed skill without per-update approval.

Install only if you are comfortable with Clawdbot and every installed skill changing automatically each day. Prefer running a dry run first, limiting updates to trusted skills where possible, reviewing changelogs, and knowing how to remove the `Daily Auto-Update` cron job before enabling it.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Error
Location
SKILL.md:24
Finding

Persistent Unattended Update Task

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
references/agent-guide.md:38
Finding

Unpinned Global and Skill-Wide Supply-Chain Updates

Content
View full analysis
/dev/null && npm list -g clawdbot &> /dev/null; then npm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v pnpm &> /dev/null && pnpm list -g clawdbot &> /dev/null; then pnpm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v bun &> /dev/null; then bun update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" else log "Running clawdbot update (source install)" clawdbot update 2>&1 | tee -a "$LOG_FILE" || true fi # Run doctor for migrations log "Running doctor..." clawdbot doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true ``` ### Technical Analysis The update procedure installs the mutable `latest` release globally and updates every installed Skill without version pinning, cryptographic integrity checks, provenance validation, change review, or an approval boundary. Consequently, code published after this Skill was audited can be installed and later executed automatically. The script also appends `|| true` to source updates, migrations, and Skill updates. This suppresses nonzero exit statuses and permits the workflow to continue after security-critical partial failures. A failed migration or incomplete update may therefore leave the installation in an inconsistent state while the routine still reaches its completion and summary logic. No evidence shows that the current package deliberately uses dependency confusion or typosquatting. The confirmed weakness is its unsafe trust in mutable third-party update sources. ### Attack Path 1. An attacker compromises ...[truncated 1494 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Self-Modification

High
Category
Rogue Agent
Confidence
95% confidence
Finding

clawdhub update --all causes the agent environment to self-modify by replacing installed skills from an external source, potentially changing future agent behavior without review. In an unattended daily cron flow, this is especially dangerous because a compromised upstream package, malicious skill update, or breaking change can be deployed automatically and persist.

Content

Scanner excerpt · references/agent-guide.md (reported line 61)May include surrounding context.

md
# Capture new version
CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown")

# Update skills
log "Updating skills via ClawdHub..."
SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true
echo "$SKILL_OUTPUT" >> "$LOG_FILE"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sets up unattended daily updates that modify Clawdbot and all installed skills, but the user-facing description does not prominently warn that software and skill files will be changed automatically on a schedule. This can lead users to enable recurring privileged modifications without fully understanding the operational and supply-chain risk, especially because clawdhub update --all updates every installed skill, including potentially sensitive or third-party ones.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The guide instructs the agent to perform unattended package, application, and skill updates plus migrations on a schedule, but it does not require explicit user confirmation, pinning, rollback, or meaningful warnings about system changes. This creates a real security and reliability risk because remote updates change executable code automatically and could introduce malicious, incompatible, or disruptive changes without oversight.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/agent-guide.md (reported line 21)May include surrounding context.

bun pm ls -g 2>/dev/null | grep clawdbot && echo "bun-global"

text

## Step 2: Create the Update Script (Optional)

For complex setups, create a helper script at `~/.clawdbot/scripts/auto-update.sh`: