ClawHub Auto Updater

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:47 AM UTC
• Version: 1.0.0

Overview

This skill openly sets up daily automatic updates, but that gives a persistent job authority to change Clawdbot and every installed skill without per-update review.

Install only if you are comfortable with Clawdbot and all installed skills changing automatically every day. Prefer configuring it to check and report updates only, or limit updates to trusted/pinned skills and require approval before installing core or skill changes.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:25

Finding

Persistent Daily Update Task Enables Unattended Cross-Session Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:25-33
Additional Location: references/agent-guide.md:72-96
Vulnerability Type: System Persistence
Risk Level: High

The skill directs the agent to install a scheduled task that survives the current session and autonomously performs future software updates.

bash

clawdbot cron add \
  --name "Daily Auto-Update" \
  --cron "0 4 * * *" \
  --tz "America/Los_Angeles" \
  --session isolated \
  --wake now \
  --deliver \
  --message "Run daily auto-updates: check for Clawdbot updates and update all skills. Report what was updated."

Technical Analysis

The clawdbot cron add command creates a persistent daily task. The task runs in an isolated session, wakes the agent, and instructs it to update both Clawdbot and installed skills. Its effects therefore extend beyond the skill's initial invocation and the user's current session.

Although persistence is consistent with the advertised auto-update purpose, it creates a durable code-execution mechanism. The scheduled task repeatedly performs security-sensitive package-management operations without requiring approval for each execution. The more detailed task in references/agent-guide.md:72-96 also instructs the scheduled agent to run package updates and clawdbot doctor --yes.

Attack Path

1. A user asks the agent to configure automatic updates.
2. The agent executes the documented clawdbot cron add command.
3. The cron definition remains installed after the original interaction ends.
4. At the configured time, Clawdbot wakes an isolated session.
5. The session follows the persistent message and invokes core and skill update commands.
6. Any malicious or compromised update available at that time is installed with the permissions of the account running the Gateway or cron task.
7. The process repeats daily until the task is explicitly removed or cron is disabled.

Impact As

...[truncated 649 chars]

Remediation

View remediation

Remediation Suggestions

1. Default to a non-persistent, check-only workflow such as clawdhub update --all --dry-run.
2. Require a separate, explicit confirmation before creating any scheduled task.
3. Display the exact schedule, commands, execution identity, affected directories, and removal command before installation.
4. Separate update discovery from update installation. The scheduled task should only report available versions; installation should require user approval.
5. Run update checks under a dedicated least-privileged account with no unnecessary access to credentials, user files, or unrelated agent tools.
6. Provide automatic expiration or require periodic renewal of the scheduled task.
7. Record an auditable task identifier and verify that clawdbot cron remove "Daily Auto-Update" fully removes the persistent configuration.
8. Do not combine scheduling with automatic migration approval such as clawdbot doctor --yes; migrations should be reviewed and approved separately.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:50

Finding

Unpinned Automatic Updates Create a Mutable Supply-Chain Execution Channel

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:50-62
Additional Location: references/agent-guide.md:39-57
Vulnerability Type: Insecure Dependencies
Risk Level: High

The update procedure installs mutable latest releases and updates every installed skill without pinning versions, verifying integrity, reviewing changes, or requesting per-update approval.

bash

npm update -g clawdbot@latest
# or: pnpm update -g clawdbot@latest
# or: bun update -g clawdbot@latest

For source installations, it also recommends:

bash

clawdbot update

All installed skills are updated using:

bash

clawdhub update --all

Technical Analysis

The @latest package specifier is mutable and resolves to whichever release the package registry currently designates as latest. Similarly, clawdhub update --all delegates selection of all replacement skill versions to the registry at execution time.

The documented workflow does not pin approved versions, enforce integrity hashes, verify release signatures or publisher identity, stage updates for review, or present diffs before installation. Because the task runs unattended, code published after this skill was audited can subsequently be installed and become part of the agent's effective behavior.

The helper script in references/agent-guide.md:39-57 suppresses some failures with || true, which may allow the workflow to continue after unsuccessful core updates or migrations and can obscure inconsistent or partially updated states.

Attack Path

1. An attacker compromises a Clawdbot or skill publisher account, registry infrastructure, distribution channel, or an upstream release process.
2. The attacker publishes a malicious release or causes it to be selected as the latest available version.
3. The daily persistent task invokes npm update -g clawdbot@latest, an equivalent package-manager command, clawdbot update, or `clawdhub update --a ...[truncated 1289 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest and blanket update behavior with explicitly approved, pinned versions.
2. Verify cryptographic signatures, publisher identity, provenance attestations, and integrity hashes before installation.
3. Resolve updates in check-only mode and present the package name, current version, proposed version, source, checksum, and release notes to the user.
4. Require explicit confirmation before installing each core or skill update, especially major-version changes.
5. Download and inspect updates in a restricted staging environment before promoting them into the live installation.
6. Maintain a trusted allowlist of registries, publishers, and package names; reject alternate or unexpected sources.
7. Avoid clawdhub update --all. Update individually approved skills so one compromised release cannot be hidden in a bulk operation.
8. Preserve verified rollback artifacts and configuration backups before applying updates or migrations.
9. Fail closed when an update or integrity check fails. Do not suppress security-relevant failures with unconditional || true.
10. Run post-update validation in a sandbox before allowing the updated component access to production credentials, user files, network services, or agent tools.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The command clawdhub update --all performs bulk self-modification of the agent's installed skills, automatically replacing executable behavior from external sources. In the context of a daily unattended cron job, this is especially dangerous because any malicious, compromised, or simply broken skill release can be pulled in and activated without review, enabling persistent compromise or disruptive behavior.

Content

Scanner excerpt · references/agent-guide.md (reported line 61)May include surrounding context.

md

# Capture new version
CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown")

# Update skills
log "Updating skills via ClawdHub..."
SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true
echo "$SKILL_OUTPUT" >> "$LOG_FILE"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly schedules unattended updates for both the core tool and all installed skills, but it does not prominently warn that automatic upgrades can introduce breaking changes, untrusted code changes from upstream, or operational instability. Because updates are applied automatically via cron and include all skills, a compromised registry package, bad release, or incompatible version could be deployed without user review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide instructs the agent to enable unattended daily updates for both the core bot and all installed skills, including bulk skill updates, without requiring explicit user approval per change, staging, pinning, or rollback controls. This creates a supply-chain and integrity risk: a compromised upstream package or skill release could be automatically installed and executed on a recurring basis, magnifying the blast radius.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/agent-guide.md (reported line 21)May include surrounding context.

bun pm ls -g 2>/dev/null | grep clawdbot && echo "bun-global"

text

## Step 2: Create the Update Script (Optional)

For complex setups, create a helper script at `~/.clawdbot/scripts/auto-update.sh`:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The cron setup hard-codes a timezone (America/Los_Angeles) instead of deriving it from user preference or system configuration. While not a direct security flaw, it can cause the job to run at an unexpected local time, which may reduce user oversight and lead to unattended updates occurring when the user does not expect them.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.