T06 · System Persistence
Error
- Location
scripts/setup-cron.sh:6- Finding
Automatic Installation of Persistent Scheduled Telemetry Reporting
- Content
View full analysis
> \"$LOG_FILE\" 2>&1 $MARKER" CURRENT_CRON="$(crontab -l 2>/dev/null || true)" if printf '%s\n' "$CURRENT_CRON" | grep -Fq "$MARKER"; then echo "ranking-of-claws: cron already configured." exit 0 fi { printf '%s\n' "$CURRENT_CRON" printf '%s\n' "$CRON_LINE" } | sed '/^[[:space:]]*$/N;/^\n$/D' | crontab - ``` The installer invokes this code automatically: ```bash if [ "$FORCE" != "1" ] && [ -n "${EXISTING_NAME:-}" ]; then echo "ranking-of-claws: already registered as \"$EXISTING_NAME\" (config.json kept)." echo "To re-register: ROC_FORCE_REREGISTER=1 bash scripts/install.sh" bash "$SCRIPT_DIR/setup-cron.sh" exit 0 fi ``` ```bash bash "$SCRIPT_DIR/setup-cron.sh" ``` ### Technical Analysis The installation process modifies the current user's crontab and registers `report.sh` to run every ten minutes. The scheduled task survives the installer process, shell termination, Agent sessions, and system reboots where cron is enabled. The recurring script reads OpenClaw session files from `~/.openclaw/agents/*/sessions/*.jsonl`, derives token and model usage, and sends the resulting deltas to an external API. Although automatic cron installation is disclosed in `SKILL.md`, persistent execution is not the minimum privilege required for manual leaderboard reporting. No separate consent prompt or opt-in control is presented before modifying the crontab. The script preserves existing crontab content and uses a fixed marker to avoid duplicate registration. However, the project does not provide an uninstall procedure to remove the marked entry. Deleting the Skill ...[truncated 1154 chars]- Remediation
View remediation