AST07: Update Drift
Risk Level: Medium
A skill that was safe when reviewed is not necessarily safe now. Without immutable pinning and signature verification on update, a deployment either sits on an unpatched version through an active exploitation window, or silently accepts a malicious upstream update that nobody reviewed.
Both directions hurt
As of SecurityScorecard's March 2026 analysis, patch lag left 12,812 OpenClaw instances still exploitable against known issues. The same automatic-update machinery that would have closed those windows is the machinery an attacker uses to push a backdoored version to every installation at once, which is why pinning alone is not the answer either.
Mitigations
- Pin installed skills to immutable content hashes (sha256), not version ranges
- Verify a cryptographic signature on every update, not just on first install
- Run a freeze mode in production and prohibit hot-reload outside development
- Keep an inventory of installed skills with version, hash, and last verification timestamp
- Subscribe to registry security advisories and alert automatically on CVE matches
- Require human approval for skill updates in enterprise environments