Auto-Updater (Windows Compatible)

• Outcome: Pass
• Latest audit: May 29, 2026, 8:20 PM
• Version:
  1.0.3

Overview

This skill is an instruction-only auto-updater that openly tells the agent to update OpenClaw and installed skills, with optional scheduling when the user asks for automation.

Install this only if you want bulk or scheduled updates for OpenClaw and all installed skills. Confirm the repo and OpenClaw home paths, review the schedule before enabling it, keep a rollback plan for local edits, and make sure you know how to disable the cron job.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill instructs the agent to create recurring automated update jobs that will execute package pulls, builds, restarts, and skill updates, but it does not require explicit user acknowledgement of the operational risks. This can cause unattended system changes, service restarts, or breakage from upstream updates, especially because the update flow includes both application and skill modifications.

VirusTotal

66/66 vendors flagged this skill as clean.