Auto Updater.Bak2

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:50 PM UTC
• Version: 1.0.0

Overview

This skill clearly says it auto-updates Clawdbot and all skills, but that gives it broad recurring authority to change executable agent behavior without per-update review.

Install only if you are comfortable with Clawdbot and every installed skill being changed automatically on a schedule. Prefer a dry-run or notification-only setup, pin or allowlist trusted skills where possible, review updates before applying them, and know how to remove the cron job before enabling it.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:25
• Finding: Persistent Daily Update Task Executes Across Sessions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:25-34` **Additional Location**: `references/agent-guide.md:76-101` **Vulnerability Type**: Scheduled-task persistence **Risk Level**: Critical ### Vulnerable Code ```bash clawdbot cron add \ --name "Daily Auto-Update" \ --cron "0 4 * * *" \ --tz "America/Los_Angeles" \ --session isolated \ --wake now \ --deliver \ --message "Run daily auto-updates: check for Clawdbot updates and update all skills. Report what was updated." ``` ### Technical Analysis The Skill instructs the agent to register a daily cron task that remains active after the setup session ends. The task wakes an isolated agent session and directs it to update the Clawdbot runtime and all installed Skills. Although the scheduled behavior is disclosed as the Skill's primary feature, it establishes a cross-session execution mechanism. The task performs recurring software modification without requiring approval for each update. Its update message is also expressed as a high-level natural-language instruction rather than as a narrowly constrained, immutable command sequence, leaving implementation decisions to the agent executing the scheduled session. ### Attack Path 1. A user asks the agent to configure the auto-updater. 2. The agent executes the documented `clawdbot cron add` command. 3. A persistent daily task is registered under the Gateway user's account. 4. At the configured time, the task wakes an isolated agent session. 5. The session obtains and installs current Clawdbot and Skill releases. 6. If an upstream package, publisher account, registry entry, or Skill release has been compromised, the persistent task installs the affected update automatically. 7. The newly installed code or Skill instructions can then affect subsequent agent operations with the permissions available to the Gateway or updater user. ### Impact Assessment The scheduled task obtains the ability to run daily across sessions and modify ...[truncated 574 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default to a notification-only or dry-run workflow: ```bash clawdhub update --all --dry-run ``` 2. Require explicit user approval before applying each core or Skill update. 3. Separate update checking from update installation. A scheduled task may check for releases, but it should not modify software automatically. 4. Display exact package names, current versions, target versions, provenance information, and integrity values before approval. 5. If unattended updates are explicitly enabled, restrict the scheduled task to a narrowly scoped script rather than a general natural-language agent instruction. 6. Run update checks in a sandbox with minimal filesystem and network permissions. 7. Add a documented expiration mechanism or periodic reauthorization requirement for the scheduled task. 8. Provide a setup-time confirmation showing the cron schedule, execution identity, affected directories, and removal command. 9. Record update attempts in tamper-resistant logs and alert the user immediately when an update fails verification. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:43
• Finding: Unpinned Unattended Core and Skill Supply-Chain Updates<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:43-58` **Additional Location**: `references/agent-guide.md:41-63` **Vulnerability Type**: Unsafe automatic dependency updates **Risk Level**: High ### Vulnerable Code ```bash npm update -g clawdbot@latest # or: pnpm update -g clawdbot@latest # or: bun update -g clawdbot@latest ``` ```bash clawdbot update ``` ```bash clawdbot doctor ``` ```bash clawdhub update --all ``` The implementation guide additionally recommends non-interactive migrations: ```bash clawdbot doctor --yes 2>&1 | tee -a "$LOG_FILE" || true ``` ### Technical Analysis The update workflow resolves the mutable `latest` package target and updates every installed Skill without specifying approved versions, cryptographic hashes, signatures, or trusted release identities. There is no documented staging, source review, integrity verification, or user confirmation before installation. Package-manager updates may execute installation lifecycle behavior, while Skill updates may introduce new scripts or agent instructions. Running `clawdbot doctor --yes` also applies migrations non-interactively. Consequently, the effective code and instruction payload can change after this Skill has been reviewed. The helper script suppresses certain failures with `|| true`, including failures from the source update, doctor operation, and Skill update capture. This can allow the routine to continue after a partial or unsuccessful update, increasing the possibility of inconsistent runtime state and reducing the reliability of failure enforcement. ### Attack Path 1. An attacker compromises an upstream publisher account, package registry entry, release pipeline, or Skill publisher. 2. The attacker publishes a malicious release under the expected Clawdbot package or an already installed Skill. 3. The daily update task resolves `clawdbot@latest` or executes `clawdhub update --all`. 4. Because no approved-version policy, signature check, hash check, ...[truncated 1265 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace mutable `@latest` targets with explicitly approved versions. 2. Verify package checksums, registry signatures, provenance attestations, and publisher identity before installation. 3. Maintain an allowlist of approved Skill identifiers, versions, and integrity hashes rather than updating all installed Skills indiscriminately. 4. Perform a dry run first and present the proposed changes to the user: ```bash clawdhub update --all --dry-run ``` 5. Download and inspect updates in an isolated staging environment before promoting them to the active installation. 6. Review Skill instruction and script diffs for newly introduced commands, network access, persistence, credential handling, or privilege requirements. 7. Disable package lifecycle scripts during retrieval or inspection where supported, and only enable them after approval. 8. Back up the runtime, configuration, and installed Skills before applying updates; implement an automatic rollback when health checks fail. 9. Do not suppress update or migration failures with unconditional `|| true`. Capture the status, stop subsequent mutation when integrity is uncertain, and report the failure prominently. 10. Avoid `doctor --yes` for unreviewed migrations. Require confirmation for migrations that alter configuration, persistent state, permissions, or installed components. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Self-Modification

High

• Category: Rogue Agent

Content

# Capture new version
CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown")

# Update skills
log "Updating skills via ClawdHub..."
SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true
echo "$SKILL_OUTPUT" >> "$LOG_FILE"

• Confidence: 98% confidence
• Finding: The script runs `clawdhub update --all`, which performs bulk self-modification of the agent's installed skills without human review. In this skill's context, that is especially risky because skills are executable agent capabilities; automatic updates can introduce malicious or unsafe behavior through a compromised publisher, dependency, or registry update.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This skill explicitly sets up unattended daily updates for the core bot and all installed skills, which will modify executable software and skill files on a schedule. While the body explains what it does, the top-level description does not present a prominent warning about automatic scheduled changes, reducing informed consent and increasing the risk of unexpected supply-chain or stability issues if an update is malicious, compromised, or simply breaking.

Session Persistence

Medium

• Category: Rogue Agent

Content

bun pm ls -g 2>/dev/null | grep clawdbot && echo "bun-global"
```

## Step 2: Create the Update Script (Optional)

For complex setups, create a helper script at `~/.clawdbot/scripts/auto-update.sh`:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide instructs the agent to set up unattended daily updates that will modify Clawdbot and all installed skills automatically, but it does not require an explicit user warning or renewed consent about ongoing software changes. This is dangerous because it enables recurring system and skill modifications, potentially pulling unreviewed code from upstream and changing runtime behavior without the user fully appreciating the trust and supply-chain risk.

Static analysis

No suspicious patterns detected.