Openclaw Auto Updater Litiao

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:57 AM UTC
• Version: 1.0.0

Overview

This skill does what it says, but its default setup creates recurring unattended jobs that can update OpenClaw and all installed skills without review.

Install only if you intentionally want recurring unattended OpenClaw maintenance. Prefer the dry-run or core-only examples first, choose your own timezone, avoid broad `--all` updates where possible, and review how to list, edit, or remove the scheduled cron job before enabling it.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:20
• Finding: Persistent Unattended Update Jobs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 20-29 **Vulnerability Type**: `T06: System Persistence` **Risk Level**: High ### Vulnerable Code ```bash openclaw cron add \ --name "OpenClaw Auto-Update" \ --cron "30 3 * * *" \ --tz "Europe/Berlin" \ --session isolated \ --wake now \ --deliver \ --message "Run daily auto-updates: 1) openclaw update --yes --json 2) clawdhub update --all 3) report versions updated + errors." ``` Additional persistent scheduling instructions appear in `SKILL.md`, lines 34-43, and `references/agent-guide.md`, lines 74-84. ### Technical Analysis The Skill instructs the Agent to register a recurring cron task that survives the current session and automatically performs software-changing operations. The task updates both the OpenClaw core and every installed Skill without requiring approval for each execution. Although scheduling automatic updates is the stated purpose of the Skill, this still creates a cross-session persistence mechanism. The use of `--yes` removes interactive confirmation for core updates, while `clawdhub update --all` permits every installed Skill to be changed. An isolated session limits session-state interaction but does not remove the persistence or software supply-chain exposure. ### Attack Path 1. A user asks the Agent to configure automatic updates. 2. The Agent executes the documented `openclaw cron add` command. 3. A persistent scheduled task is registered under the invoking user's account. 4. The task runs unattended at the configured time. 5. A compromised or malicious OpenClaw or Skill release is accepted by the automatic updater. 6. The updated component subsequently executes with the permissions available to the scheduled task owner. 7. Future scheduled executions can continue applying updates, preserving the compromise across sessions. ### Impact Assessment A successful supply-chain compromise can replace OpenClaw core components or installed Skills availa ...[truncated 550 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default scheduled jobs to update-status checks rather than installation. 2. Require explicit user approval before applying each core or Skill update. 3. Separate update discovery, review, staging, and deployment into distinct steps. 4. Pin approved versions and verify package signatures, provenance, and integrity hashes. 5. Replace `clawdhub update --all` with an explicit allowlist of reviewed Skills. 6. Run updates in a restricted sandbox or low-privilege service account. 7. Provide clear commands for listing, disabling, and removing the scheduled task. 8. Implement tested rollback procedures and retain the previously approved versions. 9. Alert the user before gateway restarts or other service-affecting changes. ]]>

T08 · Insecure Dependencies

Error

• Location: references/agent-guide.md:35
• Finding: Unpinned Global and Bulk Dependency Updates<![CDATA[ ## Vulnerability Details **File Location**: `references/agent-guide.md`, lines 35-54 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```bash if command -v npm &> /dev/null && npm list -g openclaw &> /dev/null; then npm update -g openclaw@latest 2>&1 | tee -a "$LOG_FILE" elif command -v pnpm &> /dev/null && pnpm list -g openclaw &> /dev/null; then pnpm update -g openclaw@latest 2>&1 | tee -a "$LOG_FILE" elif command -v bun &> /dev/null; then bun update -g openclaw@latest 2>&1 | tee -a "$LOG_FILE" else log "Running openclaw update (source install)" openclaw update 2>&1 | tee -a "$LOG_FILE" || true fi # Run doctor for migrations log "Running doctor..." openclaw doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version OPENCLAW_VERSION_AFTER=$(openclaw --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true ``` ### Technical Analysis The update routine installs the mutable `latest` version of OpenClaw through global package managers and updates every installed Skill through ClawHub. It does not pin an approved version, verify a cryptographic hash or signature, validate package provenance, use a dependency allowlist, or stage updates for review. The effective code installed by this routine can therefore change after the Skill itself has been audited. A compromised publisher account, registry, package release, or Skill update can turn the scheduled maintenance operation into a supply-chain code-execution channel. Global package updates increase the affected scope because they replace the OpenClaw installation used outside the current session. The exact system privileges depend on how global package management is configured; the code does not itself demonstrate privilege escalation. ### Attack Path 1. An attacker compromises a package or Skill publisher, distribution channel, or release process. ...[truncated 1151 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with explicitly approved, immutable versions. 2. Verify cryptographic integrity hashes and trusted publisher signatures before installation. 3. Enforce package provenance and use only trusted, authenticated registries. 4. Maintain an allowlist of Skills eligible for automatic update; do not use unrestricted `--all`. 5. Generate and review an update plan before modifying the live installation. 6. Test updates in an isolated staging environment with restricted credentials and network access. 7. Require explicit approval before promoting staged updates to the operational environment. 8. Disable or tightly control package lifecycle scripts where supported. 9. Preserve known-good packages and configuration for atomic rollback. 10. Alert on publisher changes, unexpected dependency changes, and integrity verification failures. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/agent-guide.md:19
• Finding: Suppressed Update and Migration Failures Can Leave an Inconsistent Installation<![CDATA[ ## Vulnerability Details **File Location**: `references/agent-guide.md`, lines 19-65 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```bash #!/bin/bash set -e LOG_FILE="${HOME}/.openclaw/logs/auto-update.log" mkdir -p "$(dirname "$LOG_FILE")" log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$LOG_FILE"; } log "Starting auto-update..." # Capture starting versions OPENCLAW_VERSION_BEFORE=$(openclaw --version 2>/dev/null || echo "unknown") # Update OpenClaw log "Updating OpenClaw..." if command -v npm &> /dev/null && npm list -g openclaw &> /dev/null; then npm update -g openclaw@latest 2>&1 | tee -a "$LOG_FILE" elif command -v pnpm &> /dev/null && pnpm list -g openclaw &> /dev/null; then pnpm update -g openclaw@latest 2>&1 | tee -a "$LOG_FILE" elif command -v bun &> /dev/null; then bun update -g openclaw@latest 2>&1 | tee -a "$LOG_FILE" else log "Running openclaw update (source install)" openclaw update 2>&1 | tee -a "$LOG_FILE" || true fi # Run doctor for migrations log "Running doctor..." openclaw doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version OPENCLAW_VERSION_AFTER=$(openclaw --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true echo "$SKILL_OUTPUT" >> "$LOG_FILE" log "Auto-update complete." # Output summary for agent to parse echo "---UPDATE_SUMMARY_START---" echo "openclaw_before: $OPENCLAW_VERSION_BEFORE" echo "openclaw_after: $OPENCLAW_VERSION_AFTER" echo "skill_output: $SKILL_OUTPUT" echo "---UPDATE_SUMMARY_END---" ``` ### Technical Analysis The script starts with `set -e`, but critical operations explicitly append `|| true`. This suppresses nonzero exit statuses from the source update, unattended migration or repair operation, and bulk Skill update. Consequently, the script can continue to log `Auto-update complete` even when one or more security-sensi ...[truncated 2055 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use strict shell settings: ```bash set -Eeuo pipefail ``` 2. Remove `|| true` from update, migration, and Skill installation commands. 3. Capture and validate each command's exit status explicitly. 4. Stop the workflow immediately after a critical update or migration failure. 5. Emit an unambiguous failed status and return a nonzero process exit code. 6. Do not log `Auto-update complete` unless every required operation succeeds. 7. Use atomic installation and migration procedures with automatic rollback. 8. Record structured results separately for core updates, migrations, and each Skill. 9. Require manual review when `openclaw doctor --yes` reports or performs unexpected changes. 10. Add tests covering interrupted downloads, package-manager failures, migration errors, and partial Skill updates. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Self-Modification

High

• Category: Rogue Agent

Content

# Capture new version
OPENCLAW_VERSION_AFTER=$(openclaw --version 2>/dev/null || echo "unknown")

# Update skills
log "Updating skills via ClawHub..."
SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true

• Confidence: 97% confidence
• Finding: The instruction `clawdhub update --all` enables autonomous self-modification of the agent's skill set, causing the environment to change over time without review. In a skill package, this is especially dangerous because it can pull in newly published or compromised skills, changing future agent behavior and potentially introducing malicious capabilities via the update channel.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly automates `openclaw update --yes` and `clawdhub update --all` on a schedule, which will modify installed software without operator review at execution time. In context this is intended functionality, but it still creates real supply-chain and operational risk because updates may introduce breaking changes, restart services, or pull compromised packages unattended.

Session Persistence

Medium

• Category: Rogue Agent

Content

bun pm ls -g 2>/dev/null | grep openclaw && echo "bun-global"
```

## Step 2: Create the Update Script (Optional)

For complex setups, create a helper script at `~/.openclaw/scripts/auto-update.sh`:

• Confidence: 83% confidence
• Finding: Creating a persistent script at `~/.openclaw/scripts/auto-update.sh` introduces durable agent-controlled behavior that can later be invoked by scheduler mechanisms, increasing persistence on the host. While this is framed as operational convenience, persistent automation in an agent context is security-sensitive because it survives beyond the initial interaction and may continue making changes without fresh user intent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide directs the agent to create a persistent helper script and schedule recurring update actions that modify the local OpenClaw installation, installed skills, and log files, but it does not present explicit safety boundaries, confirmation requirements, or warnings about the ongoing filesystem and software changes. In an agent skill context, unattended recurring modification is security-relevant because it expands the window for accidental breakage or supply-chain compromise through automatic package and skill updates.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The example states that daily updates will run at 4:00 AM in Europe/Berlin, which implies a fixed locale-specific configuration. Under the policy, forcing a specific language or locale without offering user choice or documenting a justified regional constraint is a natural-language policy violation.

Static analysis

No suspicious patterns detected.