Openclaw Auto Updater Litiao

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:57 AM UTC
• Version: 1.0.0

Overview

This skill does what it says, but its default setup creates recurring unattended jobs that can update OpenClaw and all installed skills without review.

Install only if you intentionally want recurring unattended OpenClaw maintenance. Prefer the dry-run or core-only examples first, choose your own timezone, avoid broad `--all` updates where possible, and review how to list, edit, or remove the scheduled cron job before enabling it.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:20

Finding

Persistent Unattended Update Jobs

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/agent-guide.md:35

Finding

Unpinned Global and Bulk Dependency Updates

Content

View full analysis

/dev/null && npm list -g openclaw &> /dev/null; then npm update -g openclaw@latest 2>&1 | tee -a "$LOG_FILE" elif command -v pnpm &> /dev/null && pnpm list -g openclaw &> /dev/null; then pnpm update -g openclaw@latest 2>&1 | tee -a "$LOG_FILE" elif command -v bun &> /dev/null; then bun update -g openclaw@latest 2>&1 | tee -a "$LOG_FILE" else log "Running openclaw update (source install)" openclaw update 2>&1 | tee -a "$LOG_FILE" || true fi # Run doctor for migrations log "Running doctor..." openclaw doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version OPENCLAW_VERSION_AFTER=$(openclaw --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true ``` ### Technical Analysis The update routine installs the mutable `latest` version of OpenClaw through global package managers and updates every installed Skill through ClawHub. It does not pin an approved version, verify a cryptographic hash or signature, validate package provenance, use a dependency allowlist, or stage updates for review. The effective code installed by this routine can therefore change after the Skill itself has been audited. A compromised publisher account, registry, package release, or Skill update can turn the scheduled maintenance operation into a supply-chain code-execution channel. Global package updates increase the affected scope because they replace the OpenClaw installation used outside the current session. The exact system privileges depend on how global package management is configured; the code does not itself demonstrate privilege escalation. ### Attack Path 1. An attacker compromises a package or Skill publisher, distribution channel, or release process. ...[truncated 1151 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/agent-guide.md:19

Finding

Suppressed Update and Migration Failures Can Leave an Inconsistent Installation

Content

View full analysis

> "$LOG_FILE"; } log "Starting auto-update..." # Capture starting versions OPENCLAW_VERSION_BEFORE=$(openclaw --version 2>/dev/null || echo "unknown") # Update OpenClaw log "Updating OpenClaw..." if command -v npm &> /dev/null && npm list -g openclaw &> /dev/null; then npm update -g openclaw@latest 2>&1 | tee -a "$LOG_FILE" elif command -v pnpm &> /dev/null && pnpm list -g openclaw &> /dev/null; then pnpm update -g openclaw@latest 2>&1 | tee -a "$LOG_FILE" elif command -v bun &> /dev/null; then bun update -g openclaw@latest 2>&1 | tee -a "$LOG_FILE" else log "Running openclaw update (source install)" openclaw update 2>&1 | tee -a "$LOG_FILE" || true fi # Run doctor for migrations log "Running doctor..." openclaw doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version OPENCLAW_VERSION_AFTER=$(openclaw --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true echo "$SKILL_OUTPUT" >> "$LOG_FILE" log "Auto-update complete." # Output summary for agent to parse echo "---UPDATE_SUMMARY_START---" echo "openclaw_before: $OPENCLAW_VERSION_BEFORE" echo "openclaw_after: $OPENCLAW_VERSION_AFTER" echo "skill_output: $SKILL_OUTPUT" echo "---UPDATE_SUMMARY_END---" ``` ### Technical Analysis The script starts with `set -e`, but critical operations explicitly append `|| true`. This suppresses nonzero exit statuses from the source update, unattended migration or repair operation, and bulk Skill update. Consequently, the script can continue to log `Auto-update complete` even when one or more security-sensi ...[truncated 2055 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The instruction clawdhub update --all enables autonomous self-modification of the agent's skill set, causing the environment to change over time without review. In a skill package, this is especially dangerous because it can pull in newly published or compromised skills, changing future agent behavior and potentially introducing malicious capabilities via the update channel.

Content

Scanner excerpt · references/agent-guide.md (reported line 57)May include surrounding context.

md

# Capture new version
OPENCLAW_VERSION_AFTER=$(openclaw --version 2>/dev/null || echo "unknown")

# Update skills
log "Updating skills via ClawHub..."
SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly automates openclaw update --yes and clawdhub update --all on a schedule, which will modify installed software without operator review at execution time. In context this is intended functionality, but it still creates real supply-chain and operational risk because updates may introduce breaking changes, restart services, or pull compromised packages unattended.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

Creating a persistent script at ~/.openclaw/scripts/auto-update.sh introduces durable agent-controlled behavior that can later be invoked by scheduler mechanisms, increasing persistence on the host. While this is framed as operational convenience, persistent automation in an agent context is security-sensitive because it survives beyond the initial interaction and may continue making changes without fresh user intent.

Content

Scanner excerpt · references/agent-guide.md (reported line 21)May include surrounding context.

bun pm ls -g 2>/dev/null | grep openclaw && echo "bun-global"

text

## Step 2: Create the Update Script (Optional)

For complex setups, create a helper script at `~/.openclaw/scripts/auto-update.sh`:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guide directs the agent to create a persistent helper script and schedule recurring update actions that modify the local OpenClaw installation, installed skills, and log files, but it does not present explicit safety boundaries, confirmation requirements, or warnings about the ongoing filesystem and software changes. In an agent skill context, unattended recurring modification is security-relevant because it expands the window for accidental breakage or supply-chain compromise through automatic package and skill updates.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The example states that daily updates will run at 4:00 AM in Europe/Berlin, which implies a fixed locale-specific configuration. Under the policy, forcing a specific language or locale without offering user choice or documenting a justified regional constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.