Durable Scheduler

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:56 AM UTC
• Version: 1.0.0

Overview

This skill is coherent for durable job scheduling, but it asks users to install an unpinned third-party global package and register a persistent service that can run shell and agent jobs, including privileged commands.

Install only if you trust the external `openclaw-scheduler` package and are prepared to manage a persistent background service. Pin and verify the package version, review the generated plist before bootstrapping it, avoid running jobs as root, restrict shell commands, and document how to pause, remove, and audit scheduled workflows before enabling unattended jobs.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:27

Finding

Installation of a Persistent launchd Scheduler Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–32
Vulnerability Type: Persistent startup service installation
Risk Level: High

Vulnerable Code Snippet:

bash

npm install -g openclaw-scheduler
openclaw-scheduler init
launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/ai.openclaw.scheduler.plist
openclaw-scheduler jobs list

Technical Analysis

The installation procedure initializes a scheduler configuration and then registers ai.openclaw.scheduler.plist with the user's launchd domain. According to the surrounding documentation, initialization creates the plist under ~/Library/LaunchAgents/, and the resulting scheduler operates independently of the OpenClaw gateway.

Registering a LaunchAgent creates a cross-session execution mechanism. The service can subsequently process arbitrary shell commands and agent workflows, including commands that invoke sudo. Although durable scheduling is the stated purpose of the Skill, the instructions establish persistence without first requiring explicit informed consent, presenting the generated plist for inspection, or documenting removal and rollback procedures.

Attack Path

1. An operator follows the installation instructions in SKILL.md.
2. openclaw-scheduler init creates the scheduler database and launchd property list.
3. launchctl bootstrap registers the property list in the user's graphical launchd domain.
4. The scheduler continues operating across terminal sessions and gateway restarts.
5. An attacker who compromises the installed package, scheduler configuration, database, or job-management interface can create or alter a shell job.
6. The persistent service executes the attacker-controlled job under the service user's privileges whenever its trigger conditions are met.

Impact Assessment

Successful abuse provides durable command execution under the account running the LaunchAgent. This includes access to fi ...[truncated 442 chars]

Remediation

View remediation

Remediation Suggestions

• Default to a foreground or session-scoped execution mode rather than automatically registering a LaunchAgent.
• Require explicit operator confirmation before creating or bootstrapping persistent services.
• Display the complete generated plist, executable path, arguments, environment, and permissions before registration.
• Ensure the plist and scheduler database are owned by the intended user and are not writable by other users.
• Restrict accepted shell commands through allowlists, execution policies, and least-privilege service accounts.
• Require strong authentication and authorization for job creation, modification, approval, and execution.
• Document and test complete rollback procedures, including:

  bash

  launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/ai.openclaw.scheduler.plist
  rm ~/Library/LaunchAgents/ai.openclaw.scheduler.plist
  

• Preserve tamper-evident audit records for service registration, job changes, approvals, and executions.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:28

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 28
Vulnerability Type: Unpinned global dependency installation
Risk Level: High

Vulnerable Code Snippet:

bash

npm install -g openclaw-scheduler

Technical Analysis

The command installs the latest package version available under the openclaw-scheduler name rather than an exact reviewed version. Consequently, the code installed at execution time can differ from the code that existed when this Skill was audited.

A global npm installation may also execute package lifecycle scripts during installation. No lockfile, integrity digest, signature, package provenance check, or lifecycle-script restriction is specified. The package is then entrusted to create configuration files and a launchd service, amplifying the consequences of a compromised registry account, malicious future release, or supply-chain substitution.

The audit scope contains only SKILL.md; therefore, the package implementation and its runtime behavior could not be independently verified.

Attack Path

1. An attacker compromises the package publisher, registry distribution path, or a future package release.
2. The attacker publishes a malicious version under the expected package name.
3. An operator runs the unpinned npm install -g command.
4. npm retrieves the attacker-controlled release and may execute its lifecycle scripts during installation.
5. The operator invokes the installed binary to initialize the scheduler.
6. The compromised package can modify user-accessible files and configuration and can use the subsequent launchd registration to obtain persistent execution.

Impact Assessment

Exploitation can result in arbitrary code execution with the privileges of the user running npm. Affected resources may include that user's files, credentials, npm configuration, shell configuration, OpenClaw data, scheduler database, and accessible network services.

If the ...[truncated 268 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an exact, reviewed version, for example:

  bash

  npm install -g openclaw-scheduler@<reviewed-exact-version>
  

• Publish and verify the expected package integrity digest and package provenance before installation.
• Prefer a project-local installation governed by a committed lockfile over a global installation.
• Install with lifecycle scripts disabled during verification where operationally possible:

  bash

  npm install --ignore-scripts
  

• Review all package lifecycle scripts and transitive dependencies before enabling or executing the package.
• Use a trusted internal registry or verified release artifact with reproducible-build and signature validation.
• Run installation and service initialization as a dedicated least-privilege user, never as root unless strictly required.
• Re-audit each package update before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

bash

npm install -g openclaw-scheduler
openclaw-scheduler init
launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/ai.openclaw.scheduler.plist
openclaw-scheduler jobs list

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

bash

npm install -g openclaw-scheduler
openclaw-scheduler init
launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/ai.openclaw.scheduler.plist
openclaw-scheduler jobs list

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly promotes shell execution and includes a remediation workflow that can perform system changes, but it does not clearly warn users about the operational and security risks of running destructive or privileged commands. In this context, the omission matters because the scheduler is designed for durable unattended execution, which increases the chance that a risky command will run later, repeatedly, or without fresh operator scrutiny.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The documented workflow includes a sudo remediation command, demonstrating privileged execution as a normal use case. Even with an approval step, embedding root-level remediation in a durable scheduler is dangerous because a mistaken, manipulated, or overly broad command could execute with elevated privileges and cause system compromise or destructive host changes.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

--on-output --step agent:diagnose --to "@ops"
--prompt "Investigate the failing disk and propose a fix"
--then --step approval --approver "@alex" --timeout 30m
--on-approve --step shell:remediate --command 'sudo /opt/sbin/cleanup-tmp.sh'

text

Each step persists state, retries on failure, and surfaces the run in `jobs runs`.

Static analysis

No suspicious patterns detected.