Auto Updater.Bak 2026 01 28T18:01:13+10:30

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:43 AM UTC
• Version: 1.0.0

Overview

This skill openly sets up automatic updates, but it gives a recurring agent task broad authority to change Clawdbot and every installed skill without per-update review.

Review before installing. This skill is not showing theft, hidden payloads, or destructive intent, but it will let a scheduled agent task automatically update Clawdbot and every installed skill every day. Prefer dry-run or notification-only checks, pin or approve versions, limit updates to selected trusted skills, and verify you know how to remove the cron job before enabling it.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:25

Finding

Persistent Daily Update Task Enables Cross-Session Autonomous Execution

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/agent-guide.md:32

Finding

Unpinned Unattended Updates Expose the Agent to Supply-Chain Compromise

Content

View full analysis

/dev/null || echo "unknown") # Update Clawdbot log "Updating Clawdbot..." if command -v npm &> /dev/null && npm list -g clawdbot &> /dev/null; then npm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v pnpm &> /dev/null && pnpm list -g clawdbot &> /dev/null; then pnpm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v bun &> /dev/null; then bun update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" else log "Running clawdbot update (source install)" clawdbot update 2>&1 | tee -a "$LOG_FILE" || true fi # Run doctor for migrations log "Running doctor..." clawdbot doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true echo "$SKILL_OUTPUT" >> "$LOG_FILE" ``` ### Technical Analysis The update process installs mutable `latest` releases and updates all installed Skills without version pinning, cryptographic integrity verification, provenance checks, staging, review, or per-update approval. The commands grant upstream package and Skill registries influence over code that will run locally: - `npm update -g clawdbot@latest`, `pnpm update -g clawdbot@latest`, and `bun update -g clawdbot@latest` resolve a mutable release tag. - `clawdbot update` retrieves and applies the current source update through an unspecified trust path. - `clawdhub update --all` replaces every installed Skill rather than using an explicit allowlist. - `clawdbot doctor --yes` automatically accepts migration actions after th ...[truncated 2170 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The instruction clawdhub update --all causes the agent to self-modify by fetching and applying updates to all installed skills, which can change future agent behavior without review. In the context of a scheduled auto-updater, this is especially dangerous because it creates ongoing autonomous intake of potentially malicious or compromised skill code from external sources.

Content

Scanner excerpt · references/agent-guide.md (reported line 61)May include surrounding context.

md

# Capture new version
CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown")

# Update skills
log "Updating skills via ClawdHub..."
SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true
echo "$SKILL_OUTPUT" >> "$LOG_FILE"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to configure unattended daily updates that will modify the Clawdbot installation and all installed skills, but it does not prominently warn that this causes automatic scheduled changes to executable software and local skill files. That omission can lead users to enable a persistent mechanism that silently introduces new code over time, increasing supply-chain and operational risk without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide instructs the agent to enable unattended updates that modify the installed bot, run migrations, and update all skills on a schedule, but it does not require explicit user acknowledgement of the risks of automatic system changes. This is dangerous because it creates a persistent mechanism for remote code and configuration changes from package registries or skill sources, increasing supply-chain and stability risk without an informed consent checkpoint.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

Creating a persistent helper script under ~/.clawdbot/scripts/auto-update.sh establishes durable automation that can be invoked repeatedly and may be modified or reused later. In combination with cron-based execution, this persistence increases the blast radius of any bad update logic or compromised dependency because the behavior continues automatically across sessions.

Content

Scanner excerpt · references/agent-guide.md (reported line 21)May include surrounding context.

bun pm ls -g 2>/dev/null | grep clawdbot && echo "bun-global"

text

## Step 2: Create the Update Script (Optional)

For complex setups, create a helper script at `~/.clawdbot/scripts/auto-update.sh`:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file describes configuring daily automatic updates of the core application and all installed skills, which can change system state without further user action. While it states what will be updated and when, it does not include a clear warning about the automatic modification behavior or potential impact of unattended updates.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The setup confirmation example specifies '4:00 AM (America/Los_Angeles)', which bakes in a particular locale/time zone in user-facing text. Under the language/locale policy, locale-specific defaults should be user-selected or clearly justified rather than implicitly imposed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.