OpenClaw Updater v2

• Analyzed: May 14, 2026, 4:10 AM
• Findings: 1
• Version: 1.0.0
• Hash: 449eab9695ab770bbd8a5ae791f9eb3d1a51d4f45e9abab46bd073e5f08ee7d4
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill's primary purpose, checking and applying OpenClaw updates, is benign. However, the `SKILL.md` file exposes the `OPENCLAW_UPDATE_CHECK_URL` environment variable, which allows overriding the update source URL. While this can be used for legitimate purposes (e.g., internal mirrors), it introduces a significant supply chain vulnerability. If an attacker can control this environment variable, they could direct the `openclaw update run` command to a malicious server, leading to unauthorized code execution or system compromise. This constitutes a risky capability without clear malicious intent from the skill itself, thus classifying it as suspicious.