Auto-Updater (Gateway)

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:18 AM UTC
• Version: 1.0.1

Overview

This skill is transparent about auto-updating, but it sets up persistent unattended jobs that can update all installed skills and optionally update or restart Clawdbot.

Review before installing. Replace all paths and the Telegram recipient, prefer report-only checks first, require manual approval before updating Clawdbot or restarting services, and confirm you know how to list, pause, or delete the Gateway cron job.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Self-Modification

High

• Category: Rogue Agent

Content

- `clawdbot --version`
- `clawdhub list` (skills + versions)

2) Update skills
- `clawdhub update --all`

3) (Optional) Update Clawdbot

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to run `clawdhub update --all`, which modifies installed skills by pulling and applying new code from external sources. This creates a real self-modification/supply-chain risk because a scheduled job can automatically introduce unreviewed changes into the agent environment without human approval at execution time.

Self-Modification

High

• Category: Rogue Agent

Content

- `clawdhub update --all`

3) (Optional) Update Clawdbot
- Only if the owner explicitly wants self-updates.
- After updating, run `clawdbot doctor --non-interactive`.
- Restart gateway if required.

• Confidence: 98% confidence
• Finding: The optional Clawdbot self-update and restart behavior is a true high-risk self-modification path: it can replace the running agent binary/code and restart services automatically. Even though the text says this should happen only if the owner wants it, the skill still operationalizes unattended self-updating, which can amplify compromise from a malicious upstream release or break system availability.

Self-Modification

High

• Category: Rogue Agent

Content

- **Timezone field:** in Gateway job objects this is `schedule.tz` (IANA tz like `Europe/Stockholm`).
- **Delivery:** Prefer explicit `channel` + `to` so the job always reaches you.
- **Clawdbot self-update:** can be disruptive (restarts). Run at a quiet time.

## Troubleshooting

• Confidence: 90% confidence
• Finding: This note reinforces and normalizes Clawdbot self-update behavior, including the operational consequence of restarts, which confirms the skill's intended capability to self-modify the agent at runtime. In the context of an automation skill, that makes the risk more dangerous because it is designed for recurring scheduled execution, increasing exposure to accidental or malicious upstream changes over time.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.