Weekly Skills Update

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:48 AM UTC
• Version: 0.1.0

Overview

This skill is disclosed as an updater, but it can bulk-update all installed skills and change local skill index/log files without a confirmation, version pinning, staging, or rollback guidance.

Review this before installing if you rely on stable or vetted skills. Only run it when you intentionally want every installed skill updated, preferably after backing up the current skill directory/index and reviewing pending updates. Consider replacing the global update with pinned or allowlisted updates, adding a confirmation step, and using a secure temporary file.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:20
• Finding: Unverified Workspace-Wide Supply-Chain Updates## Vulnerability Details **File Location**: `SKILL.md`, lines 20-21 **Vulnerability Type**: Unverified bulk dependency updates **Risk Level**: High **Complete Code Snippet**: ```bash cd ~/.openclaw/workspace clawhub update --all 2>&1 | tee /tmp/skills-update-output.txt ``` ### Technical Analysis The Skill instructs the Agent to update every installed Skill through a mutable external package source. It does not pin approved versions, verify package signatures or checksums, restrict publishers or source registries, inspect changes, or require confirmation before installation. Because Skills can contain executable code or instructions that influence Agent behavior, automatically replacing all installed Skills expands the trust boundary to every upstream publisher and the package distribution infrastructure. The statement that no backup is required further limits recovery from a compromised or defective update. ### Attack Path 1. An attacker compromises an upstream Skill publisher, publishing account, package registry, or update distribution channel. 2. The attacker publishes a malicious release of an installed Skill. 3. A user triggers the weekly update workflow. 4. `clawhub update --all` retrieves and installs the mutable malicious release without integrity validation or review. 5. The malicious Skill subsequently runs or its instructions are loaded into an Agent session. 6. The payload operates with the permissions available to the Agent or local user invoking that Skill. ### Impact Assessment Successful exploitation could modify multiple Skills in the user's workspace. A malicious update could influence future Agent sessions, access files available to the invoking user, invoke permitted tools, execute commands where supported, or expose data accessible within the Agent's environment. The workflow does not itself obtain elevated operating-system privileges. The effective privileges are those of the account runni ...[truncated 147 chars]
• Remediation: ## Remediation Suggestions - Maintain an allowlist of approved Skills, publishers, and registry endpoints. - Pin each Skill to an explicitly reviewed version rather than automatically accepting the latest release. - Verify cryptographic signatures or trusted checksums before installation. - Download updates into a staging area and review file, instruction, permission, and executable-code differences before activation. - Require explicit user approval for updates that add scripts, alter Agent instructions, request new permissions, or change external endpoints. - Back up the current Skill versions and index before updating, and provide an automatic rollback procedure. - Prefer updating individual Skills instead of using `--all`. - Record package provenance, previous and new versions, integrity values, and validation results in the update log.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:61
• Finding: Unpinned Global npm Installation of clawhub## Vulnerability Details **File Location**: `SKILL.md`, line 61 **Vulnerability Type**: Unpinned global third-party package installation **Risk Level**: Medium **Complete Code Snippet**: ```text npm i -g clawhub ``` ### Technical Analysis When the `clawhub` command is unavailable, the Skill tells the user to install the current npm release globally. The instruction does not specify a reviewed version, verify package provenance or integrity, or constrain npm lifecycle scripts. A global installation increases exposure because package installation scripts can execute during installation with the permissions of the invoking account. The package contents can also change independently after this Skill has been audited. ### Attack Path 1. An attacker compromises the `clawhub` npm package, its publisher account, or the relevant distribution infrastructure. 2. The attacker publishes a malicious version or modifies the package delivered under the mutable package name. 3. The user follows the fallback instruction and runs `npm i -g clawhub`. 4. npm downloads the unpinned release and may execute package lifecycle scripts. 5. Malicious code runs with the permissions of the account performing the installation and installs a globally accessible command. ### Impact Assessment Exploitation could execute code with the permissions of the user running npm and modify locations writable during global package installation. Depending on npm configuration, the installation may affect all projects or sessions using the globally installed executable. This instruction does not independently escalate privileges. If the user chooses to run it through an elevated shell, however, malicious installation code could inherit those elevated privileges.
• Remediation: ## Remediation Suggestions - Pin `clawhub` to an exact, reviewed version, such as `clawhub@<approved-version>`. - Verify the expected npm publisher, package provenance, registry URL, signature, and integrity hash before installation. - Prefer a project-local installation with a lockfile over a global installation. - Disable lifecycle scripts during initial acquisition where operationally feasible, inspect the package, and enable only required scripts after review. - Avoid recommending elevated installation commands. - Document a trusted installation source and a controlled upgrade procedure.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:21
• Finding: Predictable Shared Temporary Output File## Vulnerability Details **File Location**: `SKILL.md`, line 21 **Vulnerability Type**: Unsafe temporary-file handling **Risk Level**: Medium **Complete Code Snippet**: ```bash clawhub update --all 2>&1 | tee /tmp/skills-update-output.txt ``` ### Technical Analysis The command writes update output to a fixed, predictable path in the shared `/tmp` directory. It does not securely create the file, verify its ownership or type, assign restrictive permissions, prevent symbolic-link traversal, or remove it after use. On a multi-user system without sufficient operating-system symlink protections, another local user may create the path first or replace it with a symbolic link. Concurrent executions can also overwrite or mix results. In addition, default file permissions may expose update output to other local users, depending on the invoking user's `umask`. ### Attack Path 1. A local attacker predicts the fixed path `/tmp/skills-update-output.txt`. 2. Before the update starts, the attacker creates that path or a symbolic link at that path targeting another file writable by the victim. 3. The victim invokes the Skill. 4. `tee` opens the attacker-influenced path and writes the update output. 5. The attacker causes corruption of a victim-writable file, manipulates data later parsed from the output, or reads update details if permissions permit. Exploitation depends on local filesystem permissions, symbolic-link protections, and whether later workflow steps trust the temporary output. ### Impact Assessment The potential impact includes corruption or truncation of files writable by the invoking user, disclosure of update output, collisions between concurrent runs, and manipulation of update statistics or summaries derived from the file. The write remains constrained to the invoking user's effective permissions; the documented command does not itself provide privilege escalation. On a single-user system with robust protected- ...[truncated 75 chars]
• Remediation: ## Remediation Suggestions - Create a unique temporary file with `mktemp` rather than using a predictable filename. - Set a restrictive `umask`, such as `umask 077`, before creating the file. - Store transient data in a user-owned runtime directory where available. - Register a shell trap to remove the temporary file on normal exit and interruption. - Verify that the created path is a regular file owned by the invoking user before reading it. - Avoid following symbolic links and do not reuse an existing path. - Pass the generated filename directly between workflow steps instead of rediscovering it by a fixed name. Example hardened pattern: ```bash umask 077 output_file="$(mktemp "${TMPDIR:-/tmp}/skills-update-output.XXXXXX")" || exit 1 trap 'rm -f "$output_file"' EXIT clawhub update --all 2>&1 | tee "$output_file" ```

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill description authorizes running 'clawhub update --all' and modifying SKILLS_INDEX.md, but it does not prominently warn that invoking the skill performs system changes and file writes. This is dangerous because users may trigger it expecting a passive status check, while the skill actually performs package updates, writes logs, and alters repository state.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrase set includes a fairly generic request, '运行技能更新脚本', which can overlap with ordinary user intent and cause the skill to execute a real system-changing update command without sufficiently specific confirmation. Because activation leads directly to shell execution and workspace modification, ambiguous triggering increases the chance of unintended command execution.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: All user-facing instructions, triggers, and output examples are written only in Chinese, which implies a fixed language expectation. The file does not offer a language choice or explain that the skill is intentionally limited to a Chinese-speaking context.

Static analysis

No suspicious patterns detected.