T06 · System Persistence
Error
- Location
- README.md:303
- Finding
- Persistent Unattended Agent Execution Through Scheduled Jobs## Vulnerability Details **File Location**: `README.md:303-337`; related guidance in `SKILL.md:17-20` and `README.md:127-137` **Vulnerability Type**: Scheduled cross-session autonomous execution **Risk Level**: High ### Vulnerable Code ```markdown ## Cron Jobs for Autonomy Set up automated reporting and work triggers: ### Daily Progress Report (10 PM) ```bash openclaw cron add \ --name "Daily Progress Report" \ --cron "0 22 * * *" \ --tz "America/Vancouver" \ --session isolated \ --message "Generate daily progress report. Read tasks/QUEUE.md for completed tasks. Summarize: completed, in progress, blockers, tomorrow's plan." ``` ### Morning Kickoff (7 AM) ```bash openclaw cron add \ --name "Morning Kickoff" \ --cron "0 7 * * *" \ --tz "America/Vancouver" \ --session main \ --system-event "Morning kickoff: Review task queue, pick top priorities, spawn team members for parallel work." \ --wake now ``` ### Overnight Work Check (3 AM) ```bash openclaw cron add \ --name "Overnight Work" \ --cron "0 3 * * *" \ --tz "America/Vancouver" \ --session isolated \ --message "Overnight work session. Pull tasks from queue that don't need human input. Do research, writing, or analysis. Log progress." ``` These run automatically — no human prompt needed. ``` ### Technical Analysis The Skill instructs users to register recurring OpenClaw cron jobs that survive the original Skill invocation and initiate agent activity without a contemporaneous user request. The morning and overnight jobs are especially broad: they direct the agent to select tasks, spawn team members, and perform research, writing, or analysis without defining an authorization boundary for each operation. Use of an isolated session limits session-context exposure but does not validate queued instructions, constrain available tools, or ensure that a human has approved the task being executed. The ...[truncated 1783 chars]
- Remediation
- ## Remediation Suggestions - Do not enable recurring jobs by default or represent unattended execution as a routine installation step. - Require explicit, informed approval for each schedule, including its frequency, session type, accessible tools, runtime limits, and removal procedure. - Require separate human approval before a scheduled session executes any consequential queued task. - Restrict scheduled sessions to a dedicated least-privilege identity and an explicit allowlist of tools, network destinations, and writable paths. - Apply strict runtime, token, spending, and task-count limits to every scheduled invocation. - Validate queue-entry authorship and integrity, and reject entries created by unknown or unauthorized principals. - Prevent scheduled jobs from executing shell commands, modifying security-sensitive files, accessing credentials, or sending external messages unless individually authorized. - Record immutable audit logs containing the schedule trigger, task source, approvals, tool calls, and resulting changes. - Document commands to list, disable, and permanently remove all installed cron entries. - Prefer notification-only schedules that present proposed work to a human rather than executing it automatically.