Security audit

Auto Updater.Disabled

Security checks for vulnerabilities and agentic risk

Overview

This skill is an auto-updater as advertised, but it gives a recurring job broad authority to change Clawdbot and every installed skill without review each time.

Install only if you are comfortable with a daily scheduled job automatically changing Clawdbot and every installed skill. Prefer a dry-run or notification-only mode, restrict updates to trusted skills, review versions before applying them, and ensure the job runs as a low-privilege user with a clear removal and rollback plan.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

Location: references/agent-guide.md:77
Finding: Persistent Autonomous Update Task Installed Through Cron
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/agent-guide.md:38
Finding: Unpinned Unattended Supply-Chain Updates
Content: View full analysis
/dev/null && npm list -g clawdbot &> /dev/null; then npm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v pnpm &> /dev/null && pnpm list -g clawdbot &> /dev/null; then pnpm update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" elif command -v bun &> /dev/null; then bun update -g clawdbot@latest 2>&1 | tee -a "$LOG_FILE" else log "Running clawdbot update (source install)" clawdbot update 2>&1 | tee -a "$LOG_FILE" || true fi # Run doctor for migrations log "Running doctor..." clawdbot doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true ``` ### Technical Analysis The updater resolves the mutable `latest` package version and updates every installed Skill from the registry. The instructions do not require exact-version pinning, signature or checksum verification, provenance validation, review of package changes, a trusted publisher allowlist, staged activation, or rollback. Because future registry content is not part of the reviewed Skill package, the effective code and instructions installed by the scheduled workflow can change after this audit. Updating Skills is particularly sensitive because Skill updates can alter instructions that govern future Agent actions. ### Attack Path 1. An attacker compromises an upstream package publisher, registry account, registry infrastructure, or Skill release process. 2. The attacker publishes a malicious version that is selected ...[truncated 930 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/agent-guide.md:48
Finding: Suppressed Update and Migration Failures Permit Inconsistent State
Content: View full analysis
&1 | tee -a "$LOG_FILE" || true fi # Run doctor for migrations log "Running doctor..." clawdbot doctor --yes 2>&1 | tee -a "$LOG_FILE" || true # Capture new version CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true ``` ### Technical Analysis The script uses `|| true` after the source update, migration, and Skill update operations. This discards nonzero exit statuses and allows execution to continue after failures. The `--yes` option also approves migration actions without interactive review. Although the script begins with `set -e`, the explicit success substitution defeats fail-fast behavior for these security-sensitive operations. A partial core update, failed migration, or incomplete Skill update can therefore leave mixed component versions while the workflow proceeds and reports a summary. ### Attack Path 1. A network interruption, permission error, package conflict, malicious package behavior, or filesystem failure occurs during an update. 2. One part of the installation is modified before the command exits unsuccessfully. 3. `|| true` converts the failure into a successful shell status. 4. The script continues to migrations, version collection, or additional Skill updates. 5. The environment remains in a partially updated or incompatible state. 6. Subsequent scheduled executions operate on that inconsistent state, potentially increasing corruption or exposing behavior from an incomplete security migration. ### Impact Assessment The flaw does not independently grant new privileges, but it weakens update integrity and ...[truncated 332 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Self-Modification

High

Category: Rogue Agent
Confidence: 98% confidence
Finding: The skill explicitly performs clawdhub update --all, enabling unattended self-modification of the agent's installed skills. This is dangerous because future skill code or prompts may change behavior, introduce malicious logic, or expand capabilities without human review, and the cron job makes that persistence recurring.
Content: Scanner excerpt · references/agent-guide.md (reported line 61)May include surrounding context.
md
# Capture new version CLAWDBOT_VERSION_AFTER=$(clawdbot --version 2>/dev/null || echo "unknown") # Update skills log "Updating skills via ClawdHub..." SKILL_OUTPUT=$(clawdhub update --all 2>&1) || true echo "$SKILL_OUTPUT" >> "$LOG_FILE"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This skill schedules unattended updates that modify the Clawdbot installation and all installed skills, but the description does not prominently warn users that software and skill files will be changed automatically on a recurring basis. That omission increases the chance of uninformed consent and can lead users to enable a mechanism that silently introduces code changes from external sources, which is especially risky because it runs daily and updates all skills in bulk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide instructs the agent to configure unattended daily updates, including clawdbot doctor --yes and package-manager upgrades, without requiring explicit user acknowledgment of the operational risks. Automatic updates can introduce breaking changes, migrations, or unexpected behavior across the bot and installed skills, making this a real safety issue in an agent context.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 86% confidence
Finding: The guide instructs creation of a persistent helper script under ~/.clawdbot/scripts/auto-update.sh, which establishes durable automation on the system. While presented as operational convenience, persistent scripts combined with scheduled execution expand the attack surface and can be altered or reused later to run unintended commands.
Content: Scanner excerpt · references/agent-guide.md (reported line 21)May include surrounding context.
bun pm ls -g 2>/dev/null | grep clawdbot && echo "bun-global"

text
## Step 2: Create the Update Script (Optional) For complex setups, create a helper script at `~/.clawdbot/scripts/auto-update.sh`:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The setup confirmation normalizes unattended daily updates of the core bot and all installed skills without clearly warning that software will be modified automatically and without per-run approval. In an auto-updater context, that omission matters because users may not understand the trust and supply-chain risk of granting a recurring mechanism permission to change executable components.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The helper script persists full command output to ~/.clawdbot/logs/auto-update.log without warning that logs may contain package names, errors, paths, environment details, or other sensitive operational data. In shared systems or compromised accounts, these retained logs can expose useful reconnaissance information.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.