Security audit

Auto Updater Pro

Security checks for vulnerabilities and agentic risk

Overview

This skill is an auto-updater, but it creates recurring unattended jobs that can update the core tool and every installed skill without fresh review.

Review this before installing. It is not just a reminder skill: it can create a persistent daily job that updates Clawdbot and every installed skill. Prefer dry-run or notification-only updates, pin or approve versions manually, avoid update-all if you only trust some publishers, and verify you know how to remove the cron job and where logs are written.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

Location: SKILL.md:39
Finding: Persistent Autonomous Execution Through a Recurring Cron Job
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:94
Finding: Unpinned and Unattended Installation of Mutable Package and Skill Updates
Content: View full analysis
/dev/null && npm list -g clawdbot &> /dev/null; then npm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v pnpm &> /dev/null && pnpm list -g clawdbot &> /dev/null; then pnpm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v bun &> /dev/null; then bun update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" else log "Running clawdbot update (source install)" clawdbot update 2>&1 | tee -a "$LOG_FILE" || true fi # Run doctor for migrations log "Running doctor..." clawdbot doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true echo "$SKILL_OUTPUT" >> "$LOG_FILE" ``` ### Technical Analysis The update workflow installs the mutable `latest` package release and every available Skill update. It does not pin exact versions, verify expected cryptographic hashes or signatures, enforce a publisher allowlist, review package provenance, inspect lifecycle scripts, or require approval before installation. Package-manager updates can execute installation lifecycle scripts, while Skill updates can introduce executable code or new Agent instructions. Consequently, the effective code and instruction set executed by this Skill can change after the current ...[truncated 1942 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/agent-guide.md:48
Finding: Automated State-Changing Migration Suppresses Failures
Content: View full analysis
&1 | tee -a "$LOG_FILE" || true ``` A similar failure-suppression pattern is used for source and Skill updates: ```bash clawdbot update 2>&1 | tee -a "$LOG_FILE" || true ``` ```bash SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true ``` ### Technical Analysis The `clawdbot doctor --yes` command is described as applying migrations after an update. The `--yes` option permits state-changing actions without interactive review, while `|| true` converts a failed command pipeline into an apparent success. The script therefore continues even if a migration, repair, source update, or Skill update fails. Although the script begins with `set -e`, the explicit `|| true` clauses override fail-fast behavior for the most important update operations. This can leave the installation partially migrated while subsequent commands execute against inconsistent application state. The final `log "Auto-update complete."` message may also be written despite significant failures, producing misleading operational status. ### Attack Path 1. A newly installed release requires a migration or repair operation. 2. The automated job runs `clawdbot doctor --yes`. 3. The operation partially changes configuration or application state and then exits unsuccessfully. 4. `|| true` suppresses the failure and allows the script to continue. 5. The script captures a version, updates Skills, and logs that the automatic update is complete. 6. Subsequent Agent or Gateway activity operates against partially migrated or incompatible state. 7. The persistent cron job may repeat the process, compounding corruption or service instability. An attacker who controls a malicious or defective update could deliberately tr ...[truncated 751 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Self-Modification

High

Category: Rogue Agent
Confidence: 95% confidence
Finding: clawdhub update --all causes the agent environment to self-modify by pulling and installing updated skills from an external source. In an automated cron context, this is especially dangerous because it expands the attack surface to every installed skill and allows future upstream compromise, malicious updates, or breaking changes to be introduced without human review.
Content: Scanner excerpt · references/agent-guide.md (reported line 61)May include surrounding context.
md
# Capture new version CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true echo "$SKILL_OUTPUT" >> "$LOG_FILE"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description does not clearly warn that the skill automatically updates software and writes persistent logs to disk, which weakens informed consent for actions that change the environment and retain operational data. Users may enable the skill expecting benign status checks while it actually performs package updates, creates cron jobs, and stores update history under a workspace path.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The invocation phrase is broad enough to match routine update-related requests and could cause the skill to initiate automated package and skill updates without the user clearly intending this specific high-impact action. In this context, unintended activation is risky because the documented behavior performs system changes, schedules cron jobs, and can trigger persistent update workflows.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 78% confidence
Finding: The skill explicitly instructs persistent writes of detailed update state to a file in workspace memory, creating retained operational artifacts that may expose version data, timing, command details, and failure information to later sessions or other components with access to that directory. In an agent environment, this increases cross-session data persistence and may leak sensitive operational context beyond what is necessary for the update task.
Content: Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.
md
**Phase 1: Preparation** - Record start time - Check current version - Write to log file immediately **Phase 2: Check for Updates** - Check latest version (npm view)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/agent-guide.md (reported line 21)May include surrounding context.
bun pm ls -g 2>/dev/null | grep clawdbot && echo "bun-global"

text
## Step 2: Create the Update Script (Optional) For complex setups, create a helper script at `~/.clawdbot/scripts/auto-update.sh`:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The cron instructions schedule unattended updates for the core tool, run migrations via clawdbot doctor --yes, and update all skills without an explicit warning, review gate, or rollback guidance. This creates a real supply-chain and operational risk because future package or skill changes could alter agent behavior automatically and break workflows or introduce malicious code without user awareness at execution time.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The sample log format is written entirely in Chinese, which implies a default language choice for generated logs or reports. The document does not state that users can select their preferred language or that the locale is intentionally limited for a region-specific use case, creating a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.