T06 · System Persistence
Error
- Location
- scripts/setup-cron.sh:6
- Finding
- Automatic Installation of Persistent Scheduled Telemetry Reporting<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup-cron.sh:6-20`; invoked automatically by `scripts/install.sh:22-25` and `scripts/install.sh:51` **Vulnerability Type**: Persistent scheduled task **Risk Level**: High ### Vulnerable Code ```bash LOG_FILE="${HOME}/.openclaw/ranking-of-claws-cron.log" MARKER="# ranking-of-claws" CRON_LINE="*/10 * * * * bash \"$REPORT_SCRIPT\" >> \"$LOG_FILE\" 2>&1 $MARKER" CURRENT_CRON="$(crontab -l 2>/dev/null || true)" if printf '%s\n' "$CURRENT_CRON" | grep -Fq "$MARKER"; then echo "ranking-of-claws: cron already configured." exit 0 fi { printf '%s\n' "$CURRENT_CRON" printf '%s\n' "$CRON_LINE" } | sed '/^[[:space:]]*$/N;/^\n$/D' | crontab - ``` The installer invokes this code automatically: ```bash if [ "$FORCE" != "1" ] && [ -n "${EXISTING_NAME:-}" ]; then echo "ranking-of-claws: already registered as \"$EXISTING_NAME\" (config.json kept)." echo "To re-register: ROC_FORCE_REREGISTER=1 bash scripts/install.sh" bash "$SCRIPT_DIR/setup-cron.sh" exit 0 fi ``` ```bash bash "$SCRIPT_DIR/setup-cron.sh" ``` ### Technical Analysis The installation process modifies the current user's crontab and registers `report.sh` to run every ten minutes. The scheduled task survives the installer process, shell termination, Agent sessions, and system reboots where cron is enabled. The recurring script reads OpenClaw session files from `~/.openclaw/agents/*/sessions/*.jsonl`, derives token and model usage, and sends the resulting deltas to an external API. Although automatic cron installation is disclosed in `SKILL.md`, persistent execution is not the minimum privilege required for manual leaderboard reporting. No separate consent prompt or opt-in control is presented before modifying the crontab. The script preserves existing crontab content and uses a fixed marker to avoid duplicate registration. However, the project does not provide an uninstall procedure to remove the marked entry. Deleting the Skill ...[truncated 1154 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make scheduled reporting explicitly opt-in rather than installing it as an unconditional part of registration. 2. Display the exact schedule, executable path, log path, data sources, and destination before requesting consent. 3. Separate registration from persistence setup, for example: ```bash bash scripts/install.sh bash scripts/setup-cron.sh --enable ``` 4. Provide a dedicated uninstall operation that removes only the line containing the exact `# ranking-of-claws` marker. 5. Tie recurring execution to the Skill's enabled lifecycle through a platform-managed scheduler where possible. 6. Verify that the report script and its parent directories are owned by the expected user and are not group- or world-writable before registering the job. 7. Use an absolute path to a validated shell or invoke the executable script directly. 8. Document how to inspect, disable, and remove the scheduled task. 9. Avoid installing both cron reporting and hook-based periodic reporting, because redundant mechanisms broaden the monitoring and persistence surface. ]]>