openclaw-live-updater
What this skill does
The skill is a tool for maintaining a live OpenClaw main checkout, managing a Gateway, and performing CI and release validation. It is not a security or teaching tool but a maintenance and deployment
github/openclaw - Privilege Escalation - 385.8k stars
Threat analysis
Skill info
pkg:github/openclaw/openclaw@c39abce?skill=openclaw-live-updaterAssessments (2)
Privilege Escalation
Privilege Escalation via local-llm-review
scripts/update-main.mjs
The script uses `spawnSync` and `execFileSync` without explicit checks on the commands being executed, which could be exploited if the input is not properly sanitized.Code Obfuscation
Code Obfuscation via local-llm-review
scripts/update-main.mjs
The use of `changedPath.startsWith("apps/shared/OpenClawKit/Sources/OpenClawProtocol/"),` suggests potential obfuscation or hidden logic that may not be immediately clear.Badge
Add the Anomity scan badge for openclaw-live-updater to your README.
How Anomity governs this at runtime
Scan-time vetting tells you what a skill says it will do. Anomity's Endpoint Sensor sees what agents actually do: it discovers skills alongside every other AI artifact on the endpoint, and runtime governance can allow, deny, or log the tool calls a skill triggers. Policy violations route to your SIEM, Slack, email, or Jira, backed by a queryable 90-day audit trail.
Book a 30-minute demo to see your own skill inventory.
Methodology and disputes
Every skill is assessed by the Anomity Skill Intelligence engine against its public source; findings indicate risk patterns, not confirmed exploitation. Maintainer of openclaw-live-updater? Report an issue or request a rescan.
