Security audit

Pub Self Upgrade

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed OpenClaw self-updater, but it can make persistent service-changing upgrades with broad triggers and weaker controls than its safety description claims.

Review before installing. Use only if you intentionally want an OpenClaw self-upgrade tool with npm, GitHub, filesystem, and systemd user-service authority. Avoid using delayed cron upgrades unless the exact timing, target version, and rollback plan are clear, and prefer approving a specific version instead of openclaw@latest.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill describes shell-capable behavior including package installation, file copying, service management, and rollback, yet no permissions are declared. That creates a transparency and policy-enforcement gap: users and the platform may not realize the skill can execute privileged local actions affecting the running service.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented behavior expands beyond a simple upgrade helper into active modification of systemd unit files, daemon reload/restart operations, network fetching, and potentially direct execution without enforcing the promised user confirmation step. This mismatch is dangerous because users may consent to a review-and-confirm workflow while the skill actually performs service-impacting and self-modifying operations automatically.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Adding cron-based scheduled execution extends the skill from interactive maintenance to persistent autonomous execution. That increases risk because future upgrades could occur outside the original conversational context, potentially installing unreviewed versions or restarting services at unintended times.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases are broad enough to match ordinary requests like '帮我更新' or '检查更新', which can cause the skill to activate in contexts the user did not intend for self-upgrade. Because this skill performs package installation and service restarts, accidental triggering materially raises the chance of disruptive or unauthorized changes.

External Transmission

Medium

Category: Data Exfiltration
Content: log "查询 GitHub API 获取 release notes..." RN=$(curl -sL --connect-timeout 10 \ "https://api.github.com/repos/openclaw/openclaw/releases/tags/v2026.6.5" 2>/dev/null \ | python3 -c " import sys, json try:
Confidence: 86% confidence
Finding: The script transmits environment-originated network traffic to an external service (GitHub API) during upgrade. In a privileged maintenance workflow, unsolicited outbound requests can leak metadata such as IP, timing, and upgrade activity, and they also introduce trust in remote content that is later logged and used for operator decision support.

Self-Modification

High

Category: Rogue Agent
Content: description: "零停机升级 OpenClaw：查 release notes → 主公确认 → 旁路备份 → npm install → 重启 + 回滚兜底" --- # openclaw-self-update-zero-downtime ## 用途
Confidence: 97% confidence
Finding: This is a self-update skill for the agent itself, combining remote package retrieval, installation, and service restart. Self-modification is inherently risky because it changes the trusted codebase and execution environment; if the package source, version selection, or confirmation logic is compromised, the agent can be altered persistently.

Static analysis

No suspicious patterns detected.