update-plus

ISSUES FOUND max severity CRITICALSkillSpector Do not install 100 registry clawhub.ai last scanned 2026-02-07 1 scan

15 findings (5 critical, 3 high, 4 medium, 3 low), mainly command injection, unauthorized tool use, data exfiltration. Most recent scan 2026-02-07.

The update-plus skill presents MULTIPLE HIGH-SEVERITY security vulnerabilities primarily related to command injection and insufficient input validation. The restore functionality accepts unvalidated user input (backup_id) that is used directly in file operations and tar extraction, creating command injection and path traversal risks. The extensive use of shell scripting with user-controlled configuration values (loaded from JSON) without proper quoting and validation creates additional injection vectors throughout the codebase. MEDIUM-severity concerns include potential credential exposure through unencrypted backups of sensitive directories, undeclared tool permissions despite broad file system and network operations, and resource exhaustion risks from unbounded backup creation. The skill performs powerful operations (backup, restore, update, remote sync) but lacks adequate security controls, input validation, and user warnings about the risks involved. While the functionality is useful for system maintenance, the implementation requires significant security hardening before it can be considered safe for production use.
Scanner's overall assessment (LLM analyzer)

Findings15

Critical5

High3

Medium4

Low3

Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictDo not install 100

Score100 / 100

Issues15

CategoriesRogue Agent YARA Match Tool Misuse

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Full backup, update, and restore for OpenClaw - config, workspace, and skills with auto-rollback

Package: 10 files, 48 KB
SKILL.md: 444 words, 12+ sections
Code: Shell (7)
Requires: bins: git jq rsync
Version: 4.0.3

SKILL.md covers: 🔄 Update Plus · Quick Start · Check for available updates · Create a full backup · Update everything (creates backup first) · Preview changes (no modifications) · Restore from backup · Features · Installation · Add to PATH · Configuration · Commands

Findings

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0;31m

bin/lib/utils.sh:7

RED='\033[0;31m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0;32m

bin/lib/utils.sh:8

GREEN='\033[0;32m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[1;33m

bin/lib/utils.sh:9

YELLOW='\033[1;33m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0;34m

bin/lib/utils.sh:10

BLUE='\033[0;34m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0m

bin/lib/utils.sh:11

NC='\033[0m' # No Color

Remediation: Review and remove injection attack pattern

HIGH SYSTEM MANIPULATION detected by YARA Unauthorized Tool Usestatic

Detects system manipulation, privilege escalation, and destructive file operations: find "${BACKUP_DIR}" -name "*.log" -mtime +30 -delete

bin/lib/cron.sh:76

find "${BACKUP_DIR}" -name "*.log" -mtime +30 -delete 2>/dev/null

Remediation: Review and remove system manipulation pattern

HIGH Command Injection via Unvalidated Backup ID in Restore Function Command Injectionllm

The restore_backup() function in bin/lib/restore.sh accepts a user-provided backup_id parameter and uses it directly in file path operations and tar extraction without proper validation. An attacker could provide a malicious backup_id containing path traversal sequences (../) or command injection payloads to access arbitrary files or execute commands. The backup_id is used in: backup_path="${BACKUP_DIR}/${backup_id}" and tar -xzf "$backup_path", allowing potential directory traversal or malicious archive extraction.

bin/lib/restore.sh

restore_backup() {
  local backup_id="$1"
  ...
  local backup_path="${BACKUP_DIR}/${backup_id}"
  ...
  if ! tar -xzf "$backup_path" -C "$tmp_extract_dir" 2>/dev/null; then

Remediation: Implement strict validation for backup_id: 1) Use a whitelist pattern to ensure backup_id matches expected format (e.g., openclaw-backup-YYYY-MM-DD-HH:MM:SS.tar.gz), 2) Reject any input containing path traversal sequences (../, .., /), 3) Use basename to strip directory components, 4) Verify the resolved path stays within BACKUP_DIR using realpath validation before extraction.

HIGH Command Injection via eval and Unvalidated User Input in Multiple Functions Command Injectionllm

Multiple shell scripts use eval with user-controlled or external data without proper sanitization. In bin/lib/utils.sh, the expand_path() function uses sed to perform variable substitution which could be exploited. More critically, configuration values loaded from JSON (which could be user-modified) are used in shell commands throughout the codebase without proper quoting or validation. The jq outputs are used directly in while loops and command construction, creating injection opportunities.

bin/lib/utils.sh

expand_path() {
  local path="$1"
  echo "$path" | sed "s|\${HOME}|$HOME|g" | sed "s|~|$HOME|g"
}

# Used throughout with user-controlled paths:
dir_path=$(echo "$dir_config" | jq -r '.path')
dir_path=$(expand_path "$dir_path")

Remediation: 1) Never use eval with user-controlled input, 2) Properly quote all variable expansions in shell commands, 3) Validate and sanitize all JSON configuration values before use, 4) Use parameter expansion instead of sed for path manipulation, 5) Implement a whitelist of allowed characters for paths and configuration values, 6) Use -- to separate options from arguments in commands like tar, rsync, etc.

MEDIUM User input used in command substitution - potential injection risk Command Injectionstatic

Pattern detected: eval rsync $rsync_args "$dir_path/" "$tmp_backup_dir/$

bin/lib/backup.sh:63

eval rsync $rsync_args "$dir_path/" "$tmp_backup_dir/$dir_label/" 2>/dev/null || {

Remediation: Validate and sanitize all user inputs before using in commands

MEDIUM Potential Credential Exposure via Backup of Sensitive Directories Data Exfiltrationllm

The backup functionality backs up the entire ~/.openclaw directory by default, which may contain sensitive credentials, API keys, or tokens. The configuration allows arbitrary paths to be backed up via backup_paths in the JSON config. If users configure backups of ~/.ssh, ~/.aws, or other credential directories, these will be included in backups. While encryption is optional (ENCRYPTION_ENABLED), it defaults to false, meaning backups are stored unencrypted by default. Additionally, backups can be synced to remote storage (rclone) without enforcing encryption.

bin/lib/backup.sh

# Default backup includes entire .openclaw directory
BACKUP_PATHS_JSON=""
# Encryption is optional and defaults to false
ENCRYPTION_ENABLED="false"
# Remote storage sync without mandatory encryption
REMOTE_STORAGE_ENABLED="false"

Remediation: 1) Implement a blacklist of sensitive directories that should never be backed up (e.g., ~/.ssh, ~/.aws, ~/.gnupg), 2) Make encryption mandatory when remote storage is enabled, 3) Add warnings when backing up directories that may contain credentials, 4) Document secure backup practices in SKILL.md, 5) Consider implementing automatic detection and exclusion of common credential files (.env, *_key, *.pem, etc.).

MEDIUM Tool Restriction Violation - Undeclared Network and File System Operations Unauthorized Tool Usellm

The skill's YAML manifest does not declare allowed-tools, but the scripts perform extensive file system operations (Read, Write, Glob) and network operations (curl for connection checks, npm/pnpm for updates, rclone for remote storage, notification APIs). While allowed-tools is optional, the absence of this declaration combined with the broad scope of operations (backup, restore, update, remote sync) creates ambiguity about the skill's intended permissions. The skill can modify arbitrary files via restore operations and make network calls without explicit permission declaration.

SKILL.md

# YAML manifest missing allowed-tools
allowed-tools: Not specified

# But scripts perform:
- File operations: tar, rsync, mkdir, rm -rf
- Network operations: curl, npm, rclone
- Notifications: openclaw messaging API calls

Remediation: 1) Add explicit allowed-tools declaration to YAML manifest listing: [Read, Write, Glob, Bash, Python] to match actual behavior, 2) Document network requirements in compatibility field, 3) Consider splitting functionality into separate skills with narrower permissions (e.g., backup-only vs update-only), 4) Add user confirmation prompts before destructive operations (restore, update).

MEDIUM Potential Resource Exhaustion via Unbounded Backup Creation Resource Abusellm

The backup functionality lacks safeguards against resource exhaustion. While BACKUP_COUNT limits the number of retained backups (default 5), there are no checks for: 1) Maximum backup size before creation, 2) Total disk space consumption by all backups, 3) Rate limiting on backup creation. The check_disk_space() function only checks available space, not total consumption. An attacker or misconfiguration could trigger repeated backup operations, filling disk space. The cron job (install_cron) can be set to run at any interval without rate limiting.

bin/lib/backup.sh

# Backup count limit exists but no size limits
BACKUP_COUNT="5"
# Disk space check is optional and only checks available space
check_disk_space() {
  local required_mb="${1:-500}"
  local check_enabled="${CHECK_DISK:-true}"
# Cron can be set to any schedule without validation
install_cron() {
  local cron_schedule="${1:-0 2 * * *}"

Remediation: 1) Implement maximum backup size limits (e.g., reject backups over 10GB), 2) Add total backup directory size monitoring and alerts, 3) Implement rate limiting: prevent backup creation more than once per hour, 4) Validate cron schedules to prevent excessive frequency (minimum 1 hour intervals), 5) Add disk space monitoring with automatic cleanup when space is low, 6) Implement backup compression level options to reduce storage consumption.

LOW Skill does not specify a license Policy Violationstatic

Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

SKILL.md

Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

LOW Hardcoded Sensitive Path Patterns Without Validation Data Exfiltrationllm

The scripts contain hardcoded paths to potentially sensitive directories (~/.aws, ~/.ssh mentioned in comments/documentation) and the code walks directory trees without validating against sensitive locations. While not actively exploited in the current code, the rsync and tar operations could inadvertently include sensitive files if users configure broad backup paths. The exclude mechanism relies on user configuration rather than enforcing security boundaries.

bin/lib/backup.sh

# Rsync with user-defined excludes only
local rsync_args="-a"
while IFS= read -r exclude_pattern; do
  rsync_args="$rsync_args --exclude=$exclude_pattern"
done <<< "$dir_excludes"
# No hardcoded exclusions for sensitive paths

Remediation: 1) Implement hardcoded exclusion patterns for common sensitive files: .env, *_key, *.pem, id_rsa, credentials, 2) Add automatic detection of sensitive file patterns during backup with warnings, 3) Provide a --include-sensitive flag that must be explicitly set to backup sensitive directories, 4) Document security implications of backing up different directory types.

LOW Missing Security Warnings in Skill Description Social Engineeringllm

The skill description and documentation do not adequately warn users about security implications of the operations performed. The skill can: 1) Execute arbitrary code from git repositories during updates, 2) Restore potentially malicious backup archives, 3) Sync backups to remote storage, 4) Execute with elevated privileges via cron. The SKILL.md presents these as convenience features without security warnings about verifying backup integrity, validating update sources, or risks of automatic updates.

SKILL.md

description: Full backup, update, and restore for OpenClaw - config, workspace, and skills with auto-rollback

# No warnings about:
- Verifying backup integrity before restore
- Risks of automatic updates from git
- Remote storage security implications
- Cron job running with user privileges

Remediation: 1) Add security warnings section to SKILL.md covering: backup verification, update source validation, remote storage encryption requirements, 2) Implement backup signature verification (GPG signing), 3) Add --verify flag to validate backup integrity before restore, 4) Document threat model and trust assumptions, 5) Recommend users review update changes before applying (--dry-run first).

What is in the package

File	Kind	Size
`README.md`	doc	5.2 KB
`SKILL.md`	doc	3.5 KB
`update-plus.example.json`	config	1.1 KB
`bin/lib/backup.sh`	script	6.0 KB
`bin/lib/config.sh`	script	4.7 KB
`bin/lib/cron.sh`	script	2.4 KB
`bin/lib/notify.sh`	script	2.5 KB
`bin/lib/restore.sh`	script	7.0 KB
`bin/lib/update.sh`	script	12 KB
`bin/lib/utils.sh`	script	4.0 KB

External hosts referenced

github.com google.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

CONFIG_FILE BACKUP_DIR WORKSPACE BOT_DIR REMOTE_STORAGE_PATH WORKSPACE_DEFAULT

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://clawhub.ai/skills/update-plus
Raw scan result: update-plus-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/clawhub-ai-update-plus.svg)
Request a re-scan