ClawHub
Back to skill

Security audit

Auto Updater 1.0.0

Security checks for vulnerabilities and agentic risk

Overview

This skill openly sets up daily auto-updates, but it gives a recurring task broad authority to change Clawdbot and every installed skill without per-update review.

Install only if you are comfortable with a daily unattended task changing Clawdbot and all installed skills. Prefer using the dry-run/check-only command, reviewing available updates, pinning or allowlisting trusted components, and confirming that the cron job can be removed before enabling automatic updates.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T06 · System Persistence

Error
Location
SKILL.md:31
Finding

Persistent Unattended Update Task

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:31-40
Vulnerability Type: Persistent scheduled task with unattended software modification
Risk Level: High

Vulnerable Code

bash
clawdbot cron add \
  --name "Daily Auto-Update" \
  --cron "0 4 * * *" \
  --tz "America/Los_Angeles" \
  --session isolated \
  --wake now \
  --deliver \
  --message "Run daily auto-updates: check for Clawdbot updates and update all skills. Report what was updated."

The detailed implementation also recommends a persistent isolated-session cron task in references/agent-guide.md:67-93.

Technical Analysis

The Skill instructs the agent to register a daily scheduled task that survives the original Skill run, wakes an isolated agent session, and modifies globally installed core software and all installed skills. This is cross-session system persistence under the stated classification.

Although persistence is related to the advertised auto-update function, the task performs future software changes without requiring approval for each release. The scheduled message grants broad authority to execute package-manager and Skill-registry update operations. No update allowlist, version constraint, integrity check, staging process, or per-update confirmation boundary is specified.

Attack Path

  1. A user asks the agent to configure the advertised auto-updater.
  2. The agent executes the documented clawdbot cron add command.
  3. A recurring task is stored and remains active across later sessions and system operation.
  4. At the scheduled time, an isolated agent session wakes and receives instructions to update Clawdbot and every installed Skill.
  5. The task downloads and applies whatever releases are current at execution time.
  6. If an upstream account, registry entry, package, or Skill release has been compromised, the scheduled task installs that release without fresh user review.
  7. The installed payload subsequently executes with the permissions available to ...[truncated 696 chars]
Remediation
View remediation

Remediation Suggestions

  1. Default the scheduled task to a check-only operation such as clawdhub update --all --dry-run.
  2. Require explicit user approval before applying each core or Skill update.
  3. Maintain an allowlist of components that may be updated automatically.
  4. Pin approved versions rather than accepting an unrestricted current release.
  5. Display the publisher, requested version, provenance, integrity status, and permission changes before installation.
  6. Stage updates in a restricted sandbox and run verification tests before promotion.
  7. Run the scheduler under a dedicated least-privilege account without unnecessary access to user data or system-wide package locations.
  8. Clearly disclose the persistent task during setup and verify its exact schedule and command with clawdbot cron list.
  9. Provide and verify an immediate removal procedure.
  10. Record every scheduled execution and alert the user when the task definition changes.

T08 · Insecure Dependencies

Error
Location
SKILL.md:54
Finding

Unpinned Bulk Updates from Mutable Upstream Sources

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:54-72
Vulnerability Type: Unverified and unpinned supply-chain updates
Risk Level: High

Vulnerable Code

bash
For **npm/pnpm/bun installs**:
```bash
npm update -g clawdbot@latest
# or: pnpm update -g clawdbot@latest
# or: bun update -g clawdbot@latest

For source installs (git checkout):

bash
clawdbot update

Always run clawdbot doctor after updating to apply migrations.

Skill Updates

bash
clawdhub update --all
text

Equivalent executable update logic appears in `references/agent-guide.md:39-58`.

### Technical Analysis

The update procedure resolves the mutable `latest` package version and applies every available Skill update through `clawdhub update --all`. The reviewed documentation does not require:

- Exact version pinning
- Package hashes or lockfiles
- Cryptographic signature verification
- Publisher or provenance validation
- An approved Skill allowlist
- Review of changed permissions or behavior
- Sandboxed testing before deployment

Consequently, the effective code installed by the scheduled task can change after the Skill itself has been audited. This creates a supply-chain trust boundary in which registry state and upstream publisher accounts determine what code is installed.

The finding does not establish that any current upstream package is malicious. The vulnerability is the unrestricted, unattended consumption of mutable future releases.

### Attack Path

1. An attacker compromises an upstream publisher account, package registry entry, source repository, or Skill release channel.
2. The attacker publishes a malicious release as the newest eligible version.
3. The scheduled updater resolves `clawdbot@latest`, invokes `clawdbot update`, or runs `clawdhub update --all`.
4. Because no approved version or integrity value is enforced, the malicious release is accepted as an update.
5. The global Clawdbot installation or an installed Skill is replaced o
...[truncated 810 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest and unrestricted bulk updates with explicitly approved versions.
  2. Verify package signatures, registry provenance attestations, and cryptographic hashes before installation.
  3. Use a trusted registry configuration and reject unexpected registry or repository changes.
  4. Generate an update plan first and present component names, old and new versions, publishers, checksums, and permission changes to the user.
  5. Require confirmation before applying core updates or updates to security-sensitive Skills.
  6. Maintain an allowlist of trusted publishers and components.
  7. Download and test updates in an isolated staging environment with restricted network, filesystem, and credential access.
  8. Retain known-good packages and provide an atomic rollback mechanism.
  9. Apply updates under a dedicated least-privilege account rather than an administrative account.
  10. Alert on publisher changes, unsigned releases, dependency-tree changes, and unexpected lifecycle scripts.

T09 · Insecure Skill Coding Practices

Warning
Location
references/agent-guide.md:49
Finding

Critical Update and Migration Failures Are Suppressed

Content
View full analysis

Vulnerability Details

File Location: references/agent-guide.md:49-59
Vulnerability Type: Suppressed errors and unreliable update-state reporting
Risk Level: Medium

Vulnerable Code

bash
# Run doctor for migrations
log "Running doctor..."
clawdbot doctor --yes 2>&1 | tee -a "$LOG_FILE" || true

# Capture new version
CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown")

# Update skills
log "Updating skills via ClawdHub..."
SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true
echo "$SKILL_OUTPUT" >> "$LOG_FILE"

The script later logs "Auto-update complete." and emits summary markers even when either operation failed.

Technical Analysis

Appending || true converts nonzero exit statuses from clawdbot doctor --yes and clawdhub update --all into successful shell results. This defeats the intended fail-fast effect of set -e for two security- and consistency-critical stages.

The migration command may fail after package files have already changed, leaving an incompatible or partially migrated installation. Likewise, a bulk Skill update may update only some components before returning an error. The script captures textual output but does not preserve structured status for either operation and proceeds to emit a completion summary.

An attacker who can cause an update, migration, filesystem, or network failure does not necessarily gain code execution from this flaw alone. However, failure suppression can conceal a degraded state, failed security update, or partial installation and can make exploitation of a known-vulnerable retained component more likely.

Attack Path

  1. A core or Skill update begins.
  2. A migration or bulk Skill update fails because of a malicious package action, incompatible release, permission problem, network interruption, or storage failure.
  3. || true discards the nonzero status.
  4. The script continues despite a potentially inconsistent installation.
  5. It logs completion and em ...[truncated 862 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove || true from consistency-critical migration and update commands.
  2. Preserve each command's exit status when output is passed through tee, using set -o pipefail and explicit status variables.
  3. Stop the workflow when a required migration fails.
  4. Represent each stage with a structured status such as success, failed, or partial.
  5. Emit a completion message only when all required stages succeed.
  6. Clearly mark partial updates and identify every component whose final state is uncertain.
  7. Validate installed versions and health after each update rather than relying only on command output.
  8. Use atomic updates or snapshots and automatically roll back when migration or health checks fail.
  9. Return a nonzero process status to the scheduler whenever any required operation fails.
  10. Sanitize captured command output before including it in an agent-facing summary so that untrusted package output is treated as data rather than instructions.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Self-Modification

High
Category
Rogue Agent
Confidence
97% confidence
Finding

clawdhub update --all instructs the agent to update all installed skills, which is direct self-modification of the agent's executable capability set. In the context of a cron-driven auto-update skill, this is especially risky because it allows recurring unattended ingestion of potentially malicious or breaking skill changes from upstream sources, expanding the blast radius from a single package to the agent's full skill surface.

Content

Scanner excerpt · references/agent-guide.md (reported line 61)May include surrounding context.

md
# Capture new version
CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown")

# Update skills
log "Updating skills via ClawdHub..."
SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true
echo "$SKILL_OUTPUT" >> "$LOG_FILE"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill explicitly instructs automated daily updates of both the core bot and all installed skills, which can cause unreviewed code changes to be pulled and executed on a schedule. This increases supply-chain and stability risk because compromised upstream packages, breaking releases, or malicious skill updates would be applied automatically without explicit user confirmation or staged review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The guide directs the agent to configure unattended daily updates that modify the bot, installed skills, and potentially run migration-like repair commands (clawdbot doctor --yes) without requiring an explicit approval gate or clearly warning users about autonomous system changes. This is dangerous because it creates a standing self-modification path that can introduce breaking changes or supply-chain compromise from upstream packages/skills on a recurring schedule.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/agent-guide.md (reported line 21)May include surrounding context.

bun pm ls -g 2>/dev/null | grep clawdbot && echo "bun-global"

text

## Step 2: Create the Update Script (Optional)

For complex setups, create a helper script at `~/.clawdbot/scripts/auto-update.sh`:

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file includes natural-language text stating that daily updates will run at 4:00 AM in a specific locale/timezone. Because the policy flags language or locale constraints across all file types unless the user is offered a choice or the constraint is clearly justified, this fixed timezone is a policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.