Clawhub Smart Updater

• Outcome: Review
• Latest audit: May 28, 2026 · 1:44 PM UTC
• Version: 1.1.1

Overview

This updater has a legitimate purpose, but it can automatically change installed skills and its safety, rollback, and data-sharing disclosures are not clear enough.

Review carefully before installing. Prefer running with --dry-run and --slug first, avoid cron automation until you trust the behavior, do not enable external notifications in sensitive environments, and do not rely on the advertised restore-backup.py because it is not present in this version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_command(self, cmd: str) -> Tuple[bool, str]:
        """Run shell command and return success status and output."""
        try:
            result = subprocess.run(
                cmd,
                shell=True,
                capture_output=True,

• Confidence: 97% confidence
• Finding: The helper executes arbitrary shell strings with shell=True, and several callers interpolate untrusted skill slugs directly into those command strings. If a malicious or malformed slug contains shell metacharacters, it can trigger command injection and execute arbitrary commands in the updater user's context. Because this tool is specifically designed to process externally sourced skill identifiers from ClawHub, the context makes the issue more dangerous, not less.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The document contains materially contradictory security claims: it says the skill has no network calls beyond the local CLI and runs entirely locally, while also describing registry queries and phone-based notifications, both of which imply external communication. In a vetting report, this kind of inconsistency can mislead reviewers into underestimating the skill's data exposure and trust boundary, even if the underlying functionality is not overtly malicious.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: Claiming 'No Data Transmission' while also stating that reports may be sent via user-controlled channels and that phone notifications are used creates a false assurance about exfiltration risk. Security documentation that minimizes or obscures outbound data flows is dangerous because operators may approve or run the skill without applying appropriate review, sandboxing, or consent controls.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The dry-run verification claims 'no data transmitted,' but the report elsewhere describes optional notification behavior, leaving ambiguity about whether dry-run suppresses all outbound communications or only update actions. This is a lower-severity documentation flaw, but it still matters because users often rely on dry-run for safe validation and may be misled about residual network or messaging behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README advertises a `--force` option as simply 'skip conflict detection' without clearly warning that it can overwrite locally modified files and bypass one of the tool's primary safety controls. In an updater that modifies code and configuration, underdocumenting this behavior increases the chance of unsafe operator use and unintended loss or replacement of trusted local changes.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The configuration includes WhatsApp notifications but does not warn that update reports, skill names, version metadata, conflict details, or other operational information may be transmitted to an external third-party service. This can expose internal environment details or maintenance activity outside the local system, especially if reports contain sensitive filenames or change summaries.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The documentation clearly describes that the updater will back up and modify installed skill files, but it does not present this behavior as an explicit risk or require informed user consent before making disk changes. This is dangerous because users may run the tool assuming it is read-only or low-impact, leading to unintended modification of local skills, persistence of backup copies, and possible operational disruption if updates or merges behave unexpectedly.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill documentation promotes automated WhatsApp delivery of update reports without clearly warning that metadata about installed skills, conflicts, versions, and possibly local file paths may be sent to a third-party messaging service. This creates a privacy and information disclosure risk, especially in enterprise or sensitive environments where software inventory and change activity are confidential.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The --force path bypasses conflict detection and allows upstream code files to be copied over local files without any confirmation prompt or explicit warning at the point of overwrite. This can destroy local changes or silently install unintended code from an updated skill, which is especially risky in an updater handling third-party code. Backups reduce recovery risk but do not eliminate the possibility of unsafe or accidental overwrite.

Static analysis

No suspicious patterns detected.