Auto-Updater (Gateway)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:47 AM UTC
• Version: 1.0.1

Overview

This skill is an auto-updater as advertised, but it recommends a persistent unattended job that can update all skills, optionally update and restart Clawdbot, and send reports to a fixed Telegram recipient.

Review carefully before installing. Use this only if you intentionally want unattended updates, replace the Telegram recipient and hard-coded paths with your own verified values, prefer report-only checks or explicit approvals, and keep rollback/provenance checks for skill and Clawdbot updates.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:29

Finding

Persistent Unattended Update Task Through Gateway Cron

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:29

Finding

Update and Diagnostic Reports Sent to a Hard-Coded Telegram Recipient

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:14

Finding

Machine-Specific Executable and Workspace Paths Used in Setup Commands

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This skill instructs the scheduler to run clawdhub update --all automatically and optionally apply a Clawdbot update and restart. That is a real self-modification capability: it changes the local software and installed skills based on remote content, and when placed in an unattended cron job it increases supply-chain and integrity risk if a package, skill, account, or update channel is compromised.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

--deliver
--channel telegram
--to "2095290688"
--message "Run daily auto-update: update skills via clawdhub update --all; if Clawdbot has an update available, apply it and restart; then run clawdbot doctor --non-interactive; report what changed."

text

## What the job should do (workflow)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The explicit workflow step clawdhub update --all causes unattended modification of all installed skills. Even though the feature is presented as maintenance automation, it is still a genuine risky pattern because it can pull and execute changed skill content without human review, magnifying the blast radius of a compromised upstream dependency or account.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

- `clawdbot --version`
- `clawdhub list` (skills + versions)

2) Update skills
- `clawdhub update --all`

3) (Optional) Update Clawdbot

Self-Modification

High

• Category: Rogue Agent
• Confidence: 98% confidence

Finding

The skill recommends optional Clawdbot self-updates followed by health checks and restart, which is direct self-modification of the running agent environment. This is especially sensitive because it can replace the bot binary/runtime and immediately restart into new code during an unattended job, reducing opportunities for review and potentially enabling persistent compromise if the update source is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

- `clawdhub update --all`

3) (Optional) Update Clawdbot
- Only if the owner explicitly wants self-updates.
- After updating, run `clawdbot doctor --non-interactive`.
- Restart gateway if required.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

This note reinforces automated Clawdbot self-update behavior and frames restarts as an operational concern rather than a security-sensitive code change. In context, it normalizes unattended self-modification, which is dangerous because scheduled background execution makes malicious or faulty updates harder to notice promptly, though this line itself is less actionable than the earlier explicit commands.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

- **Timezone field:** in Gateway job objects this is `schedule.tz` (IANA tz like `Europe/Stockholm`).
- **Delivery:** Prefer explicit `channel` + `to` so the job always reaches you.
- **Clawdbot self-update:** can be disruptive (restarts). Run at a quiet time.

## Troubleshooting

Static analysis

No suspicious patterns detected.