Auto Updater 1

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:05 PM UTC
• Version: 1.0.0

Overview

This skill openly sets up automatic updates, but it should be reviewed because it creates a persistent daily job that can change Clawdbot and every installed skill without fresh approval each time.

Install only if you intentionally want unattended daily updates to Clawdbot and every installed skill. Prefer running a dry run first, limiting updates to trusted skills or approved versions, using a least-privileged account, and confirming you know how to inspect and remove the cron job.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: references/agent-guide.md:76
• Finding: Persistent Daily Update Task Executes Across Sessions<![CDATA[ ## Vulnerability Details **File Location**: `references/agent-guide.md:76-101` **Vulnerability Type**: T06: System Persistence **Risk Level**: Critical The Skill directs the Agent to register a daily scheduled task that survives the initiating session, wakes an isolated Agent session, and performs software-management operations automatically. ### Vulnerable Code ```bash ## Step 3: Add Cron Job The recommended approach is to use Clawdbot's built-in cron with an isolated session: clawdbot cron add \ --name "Daily Auto-Update" \ --cron "0 4 * * *" \ --tz "America/Los_Angeles" \ --session isolated \ --wake now \ --deliver \ --message "Run the daily auto-update routine: 1. Check and update Clawdbot: - For npm installs: npm update -g clawdbot@latest - For source installs: clawdbot update - Then run: clawdbot doctor --yes 2. Update all skills: - Run: clawdhub update --all 3. Report back with: - Clawdbot version before/after - List of skills that were updated (name + old version → new version) - Any errors encountered Format the summary clearly for the user." ``` ### Technical Analysis The `clawdbot cron add` command creates a durable scheduled execution mechanism. The `--cron "0 4 * * *"` option runs it every day, while `--session isolated` and `--wake now` permit execution independently of the session in which the Skill was configured. Although persistence is consistent with the advertised auto-update function, it creates a recurring execution path capable of changing globally installed software and all installed Skills without obtaining new authorization for each run. The security properties of future executions consequently depend on the continued integrity of Clawdbot, ClawdHub, package registries, publisher accounts, and the scheduled message. ### Attack Path 1. A user asks the Agent to configure automatic updates. 2. The Agent executes the supplied `clawdbot cron add` command. 3. A persistent daily job is ...[truncated 1000 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Default to a manual update-check workflow rather than creating a persistent task automatically. - Obtain explicit, informed confirmation immediately before registering the cron job. - Display the exact schedule, commands, target installations, execution identity, and affected directories before confirmation. - Separate update discovery from installation: run a dry check first and require approval for the identified versions. - Support one-shot jobs, expiration dates, and automatic removal after a defined number of runs. - Restrict the scheduled task to a dedicated least-privileged account. - Provide clear commands for inspecting, disabling, and removing the scheduled task. - Record every execution and preserve reliable success and failure status. ]]>

T08 · Insecure Dependencies

Error

• Location: references/agent-guide.md:41
• Finding: Unattended Installation of Mutable Latest Packages and Skill Updates<![CDATA[ ## Vulnerability Details **File Location**: `references/agent-guide.md:41-64` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: High The update script installs the mutable `latest` release of Clawdbot and updates every installed Skill without version pinning, integrity validation, review, or per-update approval. ### Vulnerable Code ```bash # Update Clawdbot log "Updating Clawdbot..." if command -v npm &> /dev/null && npm list -g clawdbot &> /dev/null; then npm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v pnpm &> /dev/null && pnpm list -g clawdbot &> /dev/null; then pnpm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v bun &> /dev/null; then bun update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" else log "Running clawdbot update (source install)" clawdbot update 2>&1 | tee -a "$LOG_FILE" || true fi # Run doctor for migrations log "Running doctor..." clawdbot doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true echo "$SKILL_OUTPUT" >> "$LOG_FILE" ``` ### Technical Analysis The `clawdbot@latest` reference is mutable and can resolve to a release that did not exist when the Skill was audited. Similarly, `clawdhub update --all` accepts future releases for every installed Skill. The workflow does not pin approved versions, verify cryptographic hashes or signatures, constrain trusted publishers, inspect package lifecycle behavior, present release diffs, or require approval before installation. Running `clawdbot doctor --yes` also permits migrations to proceed without interactive review. This creates a supply-chain exposure: the effective code and Skill instructions executed in future runs can change after the current package has been reviewed. ### Attack Path 1. An attacker compromises a ...[truncated 1241 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace `@latest` and unrestricted `--all` updates with explicitly approved, pinned versions. - Verify cryptographic integrity hashes and publisher signatures before installation. - Restrict downloads to authenticated, trusted registries and approved publisher identities. - Perform a dry run that reports exact current and proposed versions, provenance, release notes, and integrity metadata. - Require explicit approval before applying each update or approved update batch. - Review package lifecycle scripts and Skill instruction changes before installation. - Run updates in a sandbox or dedicated least-privileged account. - Maintain known-good packages and implement an atomic rollback procedure. - Define an allowlist of Skills permitted to update automatically instead of updating every installed Skill. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/agent-guide.md:54
• Finding: Critical Update and Migration Failures Are Suppressed<![CDATA[ ## Vulnerability Details **File Location**: `references/agent-guide.md:54-66` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium The helper script suppresses failures from migration and Skill-update operations by appending `|| true`, then logs that the update is complete regardless of those failures. ### Vulnerable Code ```bash # Run doctor for migrations log "Running doctor..." clawdbot doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true echo "$SKILL_OUTPUT" >> "$LOG_FILE" log "Auto-update complete." ``` ### Technical Analysis The script begins with `set -e`, which would normally terminate execution after an unhandled command failure. Appending `|| true` explicitly overrides that protection for `clawdbot doctor --yes` and `clawdhub update --all`. As a result, failed migrations and failed Skill updates are converted into successful shell control flow. The unconditional `log "Auto-update complete."` entry does not distinguish complete success from partial or total failure. Reliable detection is left to later parsing of free-form command output rather than preserved exit codes and structured status. An attacker controlling update output could also make a failure less obvious by emitting misleading text, although the audited files do not contain evidence that such an attacker is currently present. ### Attack Path 1. A Clawdbot migration or Skill update fails because of corruption, incompatibility, network interruption, permission denial, or malicious update behavior. 2. `|| true` discards the nonzero exit status. 3. The script continues despite the failed security-sensitive operation. 4. The script writes `Auto-update complete` and emits its normal summary markers. 5. A reporting Agent or operator may interpret the ru ...[truncated 691 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `|| true` from security-critical update and migration commands. - Capture and preserve the exit status of every update stage. - Stop immediately when a required migration fails. - Report partial success using explicit structured fields rather than parsing free-form output. - Return a nonzero final status whenever any required operation fails. - Log `complete` only after all required stages succeed; otherwise log `failed` or `partially complete`. - Include command name, exit code, timestamp, previous version, attempted version, and rollback status in the report. - Add rollback or restoration behavior for partially applied updates. - Avoid recommending elevated execution as a generic response to permission errors; correct ownership and least-privilege configuration instead. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Self-Modification

High

• Category: Rogue Agent

Content

# Capture new version
CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown")

# Update skills
log "Updating skills via ClawdHub..."
SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true
echo "$SKILL_OUTPUT" >> "$LOG_FILE"

• Confidence: 98% confidence
• Finding: The skill explicitly performs `clawdhub update --all`, which is direct self-modification of the agent's installed skill set. This is dangerous because it grants scheduled, unattended authority to replace or alter agent capabilities, creating a strong supply-chain compromise path and increasing the blast radius of a malicious or broken skill update.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill sets up unattended recurring updates that will modify the Clawdbot installation and all installed skills, but the user-facing description does not prominently warn that software and skill files will be changed automatically on a schedule. This can lead to users enabling persistent self-modification without fully understanding the trust and supply-chain implications, especially because `clawdhub update --all` pulls and applies remote changes across all skills.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide instructs the agent to perform unattended updates to the core bot and all installed skills, which can change code, behavior, dependencies, and configuration without any explicit warning, approval gate, or rollback guidance. In an agent context, automatic self-updating materially increases supply-chain and operational risk because compromised packages or breaking changes can be applied silently on a schedule.

Session Persistence

Medium

• Category: Rogue Agent

Content

bun pm ls -g 2>/dev/null | grep clawdbot && echo "bun-global"
```

## Step 2: Create the Update Script (Optional)

For complex setups, create a helper script at `~/.clawdbot/scripts/auto-update.sh`:

• Confidence: 81% confidence
• Finding: The guide recommends creating a persistent helper script under `~/.clawdbot/scripts/auto-update.sh`, which establishes durable executable state that can be reused by future runs. In combination with cron-based execution and update authority, this persistence increases risk because any later tampering with that script can repeatedly execute under the user's automation flow.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The customization example allows delivery of update summaries to external providers such as Telegram, but it does not warn that logs or update results may contain sensitive operational details, package names, errors, paths, or other metadata. This can unintentionally disclose environment information to third-party services or recipients if misconfigured.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The setup confirmation example states that daily updates will run at 4:00 AM in America/Los_Angeles. This natural-language example enforces a specific locale/time zone and does not indicate user opt-in, configurability, or a region-specific requirement.

Static analysis

No suspicious patterns detected.