Security audit
Security checks for vulnerabilities and agentic risk
This skill is a GitHub updater for OpenClaw skills, but it can persistently change installed skill code from remote repositories without an explicit confirmation or diff step.
Review this carefully before installing. It is intended to update skills, so use the check command first, verify each skill's GitHub origin and pending diff, avoid bulk updates for untrusted repositories, and keep backups of local skill changes.
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
sh skills/github-skill-updater/scripts/github-skill-updater update skills/<skill-name>
The skill performs self-modification or modification of peer skills by pulling and updating code from GitHub into local skill directories. Even with stated safeguards like check-before-update and fast-forward-only, this is still a high-risk operation because it changes executable prompt/code content from a remote source and could introduce malicious or compromised updates into the agent environment.
更新单个 skill：
./skills/github-skill-updater/scripts/github-skill-updater update skills/<skill-name>
也可以直接调用 Python 主脚本：
This markdown file is written entirely in Chinese and does not provide an alternative language option or state that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a reportable issue.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
如果你直接从 GitHub 获取源码，可将本目录复制到 OpenClaw workspace 的 skills/ 目录下：
mkdir -p ~/.openclaw/workspace/skills
cp -R github-skill-updater ~/.openclaw/workspace/skills/
The skill instructs use of shell commands and an update workflow that can modify local skill code, but it does not declare any explicit tool scope such as allowed-tools or permissions. That mismatch weakens policy enforcement and can let an agent invoke capabilities broader than a reviewer or runtime expects, especially when operating on local repositories and scripts.
The file’s user-facing description, trigger phrases, and operational guidance are entirely in Chinese, which implies the skill is intended to activate based on Chinese-language input only. There is no opt-in, alternative language support, or documented justification that this is a China-specific or language-restricted tool, so it creates a natural-language locale policy concern.
The natural-language metadata is written entirely in Chinese, which imposes a specific language/locale choice in the skill definition without indicating user selection or a region-specific justification. That creates a language policy concern because the skill does not offer a language choice or document why Chinese-only text is required.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_git(repo: Path, args: list[str], check: bool = True) -> subprocess.CompletedProcess[str]:
return subprocess.run(
["git", *args],
cwd=repo,
check=check,
The update path executes git pull --ff-only and git checkout to change the local repository state, which are file-modifying operations. Although these actions are part of the tool's purpose, the code provides no visible confirmation prompt or user-facing disclosure at the moment the changes are performed.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def git(args, cwd):
subprocess.run(
["git", *args],
cwd=cwd,
check=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def git_output(args, cwd):
return subprocess.run(
["git", *args],
cwd=cwd,
check=True,
The test requires result.message to contain the Chinese phrase "未提交改动", which effectively enforces a specific output language. This is a natural-language locale constraint, and the file does not indicate any user choice or documented region-specific justification for requiring Chinese.
This manifest describes the skill's purpose and behavior but does not specify when it should activate, what exact user requests should invoke it, or any exclusions. In a manifest file, that lack of trigger specificity can lead to unintended invocation from broad update-related requests.
Multiple user-visible messages returned in reports are written only in Chinese, while the script description and CLI help are in English. This forces a specific language for part of the user experience without opt-in or documentation justifying the locale constraint.
No suspicious patterns detected.