Auto Updater Pro

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:05 PM UTC
• Version: 1.1.0

Overview

This skill is an auto-updater, but it creates recurring unattended jobs that can update the core tool and every installed skill without fresh review.

Review this before installing. It is not just a reminder skill: it can create a persistent daily job that updates Clawdbot and every installed skill. Prefer dry-run or notification-only updates, pin or approve versions manually, avoid update-all if you only trust some publishers, and verify you know how to remove the cron job and where logs are written.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:39
• Finding: Persistent Autonomous Execution Through a Recurring Cron Job<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:39-47`, `SKILL.md:55-67`, `references/agent-guide.md:70-94` **Vulnerability Type**: Persistent scheduled task **Risk Level**: Critical ### Vulnerable Code ```bash clawdbot cron add \ --name "Daily Auto-Update" \ --cron "0 4 * * *" \ --tz "America/Los_Angeles" \ --session isolated \ --wake now \ --deliver \ --message "Run daily auto-updates: check for Clawdbot updates and update all skills. Report what was updated." ``` The recommended configuration further enables automatic recovery of missed executions: ```json { "schedule": { "expr": "0 4 * * *", "kind": "cron", "tz": "Asia/Shanghai" }, "missedRunPolicy": "run-immediately", "payload": { "kind": "agentTurn", "message": "...", "timeoutSeconds": 600 } } ``` The Agent guide supplies a more extensive persistent cron payload: ```bash clawdbot cron add \ --name "Daily Auto-Update" \ --cron "0 4 * * *" \ --tz "America/Los_Angeles" \ --session isolated \ --wake now \ --deliver \ --message "Run the daily auto-update routine: 1. Check and update Clawdbot: - For npm installs: npm update -g clawdbot@latest - For source installs: clawdbot update - Then run: clawdbot doctor --yes 2. Update all skills: - Run: clawdhub update --all 3. Report back with: - Clawdbot version before/after - List of skills that were updated (name + old version → new version) - Any errors encountered Format the summary clearly for the user." ``` ### Technical Analysis The Skill instructs an Agent to create a recurring scheduled task that survives the originating Skill invocation and Agent session. The task launches isolated Agent turns that perform state-changing update operations. The `missedRunPolicy` value of `run-immediately` causes an execution to occur when the Gateway returns after being unavailable, while `--wake now` further increases autonomous availability. Although scheduled upda ...[truncated 1974 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default to update notifications or dry-run checks rather than unattended installation. 2. Require explicit, informed user confirmation immediately before creating a persistent cron task. 3. Display the exact schedule, payload, execution account, update sources, and removal command before installation. 4. Do not enable `missedRunPolicy: "run-immediately"` unless the user specifically requests it. 5. Replace the natural-language cron payload with a fixed, locally stored, reviewed script whose integrity is verified before execution. 6. Restrict the scheduled task to checking for updates; require separate approval before applying each proposed version. 7. Run the task under a dedicated least-privileged service account with write access only to necessary package and Skill directories. 8. Add a verified removal procedure and confirm that the cron entry has actually been deleted when automatic updates are disabled. 9. Record immutable audit events for task creation, modification, execution, and removal. 10. Apply execution locking so missed and scheduled runs cannot overlap. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:94
• Finding: Unpinned and Unattended Installation of Mutable Package and Skill Updates<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:94-106`, `SKILL.md:164-169`, `references/agent-guide.md:39-57`, `references/agent-guide.md:78-88` **Vulnerability Type**: Unsafe software supply-chain update process **Risk Level**: High ### Vulnerable Code ```bash npm update -g clawdbot@latest # or: pnpm update -g clawdbot@latest # or: bun update -g clawdbot@latest ``` ```bash clawdbot update ``` ```bash clawdhub update --all ``` The optional helper script automates the same mutable update operations: ```bash # Update Clawdbot log "Updating Clawdbot..." if command -v npm &> /dev/null && npm list -g clawdbot &> /dev/null; then npm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v pnpm &> /dev/null && pnpm list -g clawdbot &> /dev/null; then pnpm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v bun &> /dev/null; then bun update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" else log "Running clawdbot update (source install)" clawdbot update 2>&1 | tee -a "$LOG_FILE" || true fi # Run doctor for migrations log "Running doctor..." clawdbot doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true echo "$SKILL_OUTPUT" >> "$LOG_FILE" ``` ### Technical Analysis The update workflow installs the mutable `latest` package release and every available Skill update. It does not pin exact versions, verify expected cryptographic hashes or signatures, enforce a publisher allowlist, review package provenance, inspect lifecycle scripts, or require approval before installation. Package-manager updates can execute installation lifecycle scripts, while Skill updates can introduce executable code or new Agent instructions. Consequently, the effective code and instruction set executed by this Skill can change after the current ...[truncated 1942 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace mutable `@latest` references with exact, explicitly approved versions. 2. Perform a dry run first and present package names, current versions, proposed versions, publishers, and release provenance to the user. 3. Require explicit approval before applying updates, particularly major releases and newly introduced dependencies. 4. Verify registry signatures, provenance attestations, and expected cryptographic checksums before installation. 5. Maintain an allowlist of approved package and Skill publishers. 6. Update only specifically approved Skills rather than using `clawdhub update --all`. 7. Disable or sandbox package lifecycle scripts where supported. 8. Stage updates in an isolated environment and run security, compatibility, and health checks before promotion. 9. Retain known-good versions and implement an automatic rollback procedure if verification or health checks fail. 10. Record resolved versions and integrity data in a lockfile or equivalent immutable update manifest. 11. Alert and stop if publisher ownership, source repository, signing identity, or package provenance changes. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/agent-guide.md:48
• Finding: Automated State-Changing Migration Suppresses Failures<![CDATA[ ## Vulnerability Details **File Location**: `references/agent-guide.md:48-50` **Vulnerability Type**: Unsafe error handling for state-changing operations **Risk Level**: Medium ### Vulnerable Code ```bash # Run doctor for migrations log "Running doctor..." clawdbot doctor --yes 2>&1 | tee -a "$LOG_FILE" || true ``` A similar failure-suppression pattern is used for source and Skill updates: ```bash clawdbot update 2>&1 | tee -a "$LOG_FILE" || true ``` ```bash SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true ``` ### Technical Analysis The `clawdbot doctor --yes` command is described as applying migrations after an update. The `--yes` option permits state-changing actions without interactive review, while `|| true` converts a failed command pipeline into an apparent success. The script therefore continues even if a migration, repair, source update, or Skill update fails. Although the script begins with `set -e`, the explicit `|| true` clauses override fail-fast behavior for the most important update operations. This can leave the installation partially migrated while subsequent commands execute against inconsistent application state. The final `log "Auto-update complete."` message may also be written despite significant failures, producing misleading operational status. ### Attack Path 1. A newly installed release requires a migration or repair operation. 2. The automated job runs `clawdbot doctor --yes`. 3. The operation partially changes configuration or application state and then exits unsuccessfully. 4. `|| true` suppresses the failure and allows the script to continue. 5. The script captures a version, updates Skills, and logs that the automatic update is complete. 6. Subsequent Agent or Gateway activity operates against partially migrated or incompatible state. 7. The persistent cron job may repeat the process, compounding corruption or service instability. An attacker who controls a malicious or defective update could deliberately tr ...[truncated 751 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `|| true` from all state-changing update and migration commands. 2. Capture and validate each pipeline exit status, including the original command's status when output is piped through `tee`. 3. Stop the workflow immediately if a core update, migration, integrity check, or health check fails. 4. Avoid `--yes` for potentially destructive repairs unless the exact actions have been pre-reviewed and explicitly authorized. 5. Distinguish successful, partially successful, skipped, and failed operations in the final report. 6. Create a configuration and application-state backup before running migrations. 7. Run post-migration health and compatibility checks before updating Skills or declaring completion. 8. Roll back to the known-good version and restore backed-up state when migration validation fails. 9. Return a nonzero process status and generate a prominent alert on any failed update stage. 10. Add an execution lock to prevent another scheduled run from operating on partially updated state. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Self-Modification

High

• Category: Rogue Agent

Content

# Capture new version
CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown")

# Update skills
log "Updating skills via ClawdHub..."
SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true
echo "$SKILL_OUTPUT" >> "$LOG_FILE"

• Confidence: 95% confidence
• Finding: `clawdhub update --all` causes the agent environment to self-modify by pulling and installing updated skills from an external source. In an automated cron context, this is especially dangerous because it expands the attack surface to every installed skill and allows future upstream compromise, malicious updates, or breaking changes to be introduced without human review.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The description does not clearly warn that the skill automatically updates software and writes persistent logs to disk, which weakens informed consent for actions that change the environment and retain operational data. Users may enable the skill expecting benign status checks while it actually performs package updates, creates cron jobs, and stores update history under a workspace path.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The invocation phrase is broad enough to match routine update-related requests and could cause the skill to initiate automated package and skill updates without the user clearly intending this specific high-impact action. In this context, unintended activation is risky because the documented behavior performs system changes, schedules cron jobs, and can trigger persistent update workflows.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Phase 1: Preparation**
- Record start time
- Check current version
- Write to log file immediately

**Phase 2: Check for Updates**
- Check latest version (npm view)

• Confidence: 78% confidence
• Finding: The skill explicitly instructs persistent writes of detailed update state to a file in workspace memory, creating retained operational artifacts that may expose version data, timing, command details, and failure information to later sessions or other components with access to that directory. In an agent environment, this increases cross-session data persistence and may leak sensitive operational context beyond what is necessary for the update task.

Session Persistence

Medium

• Category: Rogue Agent

Content

bun pm ls -g 2>/dev/null | grep clawdbot && echo "bun-global"
```

## Step 2: Create the Update Script (Optional)

For complex setups, create a helper script at `~/.clawdbot/scripts/auto-update.sh`:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The cron instructions schedule unattended updates for the core tool, run migrations via `clawdbot doctor --yes`, and update all skills without an explicit warning, review gate, or rollback guidance. This creates a real supply-chain and operational risk because future package or skill changes could alter agent behavior automatically and break workflows or introduce malicious code without user awareness at execution time.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The sample log format is written entirely in Chinese, which implies a default language choice for generated logs or reports. The document does not state that users can select their preferred language or that the locale is intentionally limited for a region-specific use case, creating a natural-language policy concern.

Static analysis

No suspicious patterns detected.