Skills
Navigate
skills/jdrhyne/agent-skills/auto-updater/Gen Agent Trust Hub

auto-updater

Fail

Audited by Gen Agent Trust Hub on Jul 8, 2026

Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill establishes a persistence mechanism by scheduling a recurring task through the system's cron utility to ensure updates run daily.
  • Evidence: openclaw cron add --name "Daily Auto-Update" --cron "0 4 * * *" in SKILL.md.
  • [EXTERNAL_DOWNLOADS]: The skill is configured to fetch software updates from the NPM registry and the ClawHub repository.
  • Evidence: npm update -g openclaw@latest and clawhub update --all in SKILL.md.
  • Context: The skill fetches updates from the NPM registry (a well-known service) and ClawHub (the vendor's skill repository).
  • [REMOTE_CODE_EXECUTION]: The skill performs automated background installation of code to modify the agent core and its extensions.
  • Evidence: The helper script ~/.clawdbot/scripts/auto-update.sh described in references/agent-guide.md executes update commands that install and run new code from remote sources.
  • [COMMAND_EXECUTION]: The skill generates and executes shell scripts to perform environment modifications and health checks.
  • Evidence: Commands such as openclaw --profile default doctor --fix and openclaw gateway restart are used to modify the running state of the system.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jul 8, 2026, 04:46 PM
Security Audit — agent-trust-hub — auto-updater