Security audit

Oc Self Update

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed OpenClaw updater that checks npm versions and only installs a selected OpenClaw channel after user-directed confirmation.

Install only if you want the agent to manage OpenClaw updates through npm. Before confirming an update, check the target channel, prefer stable unless you intentionally want beta or dev, and remember the gateway restart remains a separate manual step.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Self-Modification

High

Category: Rogue Agent
Content: ## 1.0.2 Fix README install slug to match folder name (`oc-self-update`). ## 1.0.1
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

Category: Rogue Agent
Content: ## 1.0.2 Fix README install slug to match folder name (`oc-self-update`). ## 1.0.1
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

Category: Rogue Agent
Content: # OpenClaw Update Check for OpenClaw updates and self-update the installation. ## Requirements
Confidence: 90% confidence
Finding: This skill is designed to self-update the OpenClaw installation, which is an inherently sensitive capability because it replaces or modifies executable code on the system. Even if intended as a legitimate updater, compromise of the update path, package source, or release channel could lead to execution of untrusted code with the permissions of the current user.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code accurately implements the 'check for updates' portion of the description by comparing the installed global npm package version to the latest available version. However, the declared purpose also says the skill can 'self-update the installation' and should be used to 'upgrade the bot' or 'install a new version.' No installation or update command is present; the script only prints status and exits with 0 or 1. This is a material description-to-behavior mismatch because a primary declared capability is missing.

Self-Modification

High

Category: Rogue Agent
Content: --- name: oc-self-update description: Check for OpenClaw updates and self-update the installation. Use when the user asks to update OpenClaw, check for updates, upgrade the bot, install a new version, or says a new release is available. metadata: {"openclaw":{"requires":{"bins":["npm"]}}} ---
Confidence: 93% confidence
Finding: This skill is explicitly designed to modify the running tool by performing a global `npm install -g` of the agent package. Self-modification is inherently dangerous because it executes a remote package update path with system-level side effects, potentially allowing supply-chain compromise, installation of an unintended channel, or disruption of the current deployment.

Self-Modification

High

Category: Rogue Agent
Content: --- name: oc-self-update description: Check for OpenClaw updates and self-update the installation. Use when the user asks to update OpenClaw, check for updates, upgrade the bot, install a new version, or says a new release is available. metadata: {"openclaw":{"requires":{"bins":["npm"]}}} ---
Confidence: 93% confidence
Finding: The description instructs the agent to self-update when asked to 'upgrade the bot' or 'install a new version', which broadens the conditions under which a privileged self-modifying action may occur. Because the action installs software globally from npm, any mistaken invocation or compromised dependency path can directly alter the agent's executable environment.

Self-Modification

High

Category: Rogue Agent
Content: metadata: {"openclaw":{"requires":{"bins":["npm"]}}} --- # OpenClaw Self-Update OpenClaw is distributed as an npm package. Version scheme: `YYYY.M.D` (date-based).
Confidence: 90% confidence
Finding: The skill context confirms that this is a self-update mechanism for the agent itself, not a harmless reference. In context, that makes the self-modification pattern more dangerous because the skill is expressly authorized to change its own installed codebase, increasing exposure to supply-chain attacks and operational instability if triggered incorrectly.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The README explicitly states that the skill can self-update the OpenClaw installation and switch release channels, but it does not prominently warn users about the security and stability implications of modifying a globally installed package. Self-update functionality changes trusted code on the host system, so lack of clear user-facing warnings increases the risk of accidental or uninformed execution.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The invocation text is broad enough that a generic request like 'install a new version' or 'a new release is available' could trigger this skill outside a clearly scoped OpenClaw-update context. In an agent system, over-broad routing can lead to unintended execution of a privileged self-update workflow, including global package installation.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: The entry "Translate all prompts and examples to English" is natural-language content that suggests the skill standardizes user-facing content to English. Because no user choice or region-specific justification is present in this file, this may conflict with language/locale policy requirements.

Static analysis

No suspicious patterns detected.