Auto Updater.Disabled

• Outcome: Review
• Latest audit: May 29, 2026 at 9:30 PM UTC
• Version:
  1.0.0

Overview

This skill openly sets up unattended daily updates, but it can automatically change Clawdbot and every installed skill without per-update approval.

Install only if you intentionally want unattended updates to the agent and every installed skill. Safer use is to run dry-run or manual updates first, review what will change, and keep the documented cron removal command available.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This skill explicitly configures unattended daily updates that modify both Clawdbot and all installed skills, but it does not prominently warn the user about the risks of automatic changes to their local environment. Automatically pulling and applying updates on a schedule expands the trust boundary to remote registries and package sources, and can introduce unexpected breakage or supply-chain compromise without a fresh approval step.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide instructs the agent to set up unattended daily updates that modify the bot installation, run migrations, and update all installed skills without requiring an approval gate at execution time. Because this pulls and applies new code automatically from external package sources and skill repositories, it creates a meaningful supply-chain and availability risk if an upstream package, skill, or migration is malicious, compromised, or simply breaking.

VirusTotal

60/60 vendors flagged this skill as clean.