skills/openclaw/skills/auto-updater/Gen Agent Trust Hub

auto-updater

Warn

Audited by Gen Agent Trust Hub on Mar 14, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The script scripts/check_update.sh implements an automated update mechanism that fetches code from a remote Git repository (git fetch --tags) and switches the local environment to that code (git checkout). It then proceeds to execute installation and build processes (pnpm install, pnpm build, docker build) on the newly acquired remote code.
  • [COMMAND_EXECUTION]: The skill requires and executes high-privilege system commands including git, docker, docker compose, pnpm, and npm. These commands are used to manage the host's software state and container infrastructure.
  • [EXTERNAL_DOWNLOADS]: The skill connects to external Git remotes to fetch tags and to package registries (NPM) to download dependencies during the update process.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by reading unvalidated data from external sources and presenting it to the agent.
  • Ingestion points: Git commit messages (git log) and the CHANGELOG.md file from the remote repository are read and processed.
  • Boundary markers: None. External content is interpolated directly into the output.
  • Capability inventory: The skill has extensive host capabilities including shell access, Docker management, and package installation across scripts/check_update.sh.
  • Sanitization: The script uses a Python helper to encode the data into a JSON array, but it does not perform any filtering or sanitization of the natural language content for potential instructions meant to manipulate the LLM.
  • [COMMAND_EXECUTION]: The script scripts/check_update.sh spawns a Python interpreter to execute a one-liner for JSON processing of Git logs.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 14, 2026, 11:05 AM