T06 · System Persistence
- Location
SKILL.md:136- Finding
Persistent Scheduled Agent with Shell Execution Capability
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:136-160
Vulnerability Type: Cross-session scheduled-task persistence
Risk Level: HighVulnerable Code
bash openclaw cron add \ --name "eyun-watch-poll" \ --every "5m" \ --session isolated \ --message "Call the Eyun watch results API and notify the user if there are new freight results. Steps: 1. Run this command: curl -s -X GET \"{EYUN_BASE_URL}/api/v1/watch-results/push\" -H \"company-id: {EYUN_COMPANY_ID}\" 2. Parse the JSON response. - If 'data' is an empty array: do nothing, output nothing. - If 'data' has items: format each item as a freight rate notification (route, carrier, price, ETD) and output the summary. Output language: Chinese." \ --tools exec \ --announce \ --channel {channel} \ --to {to}This behavior is corroborated by the deployment instructions at
README.md:48-65, which also create a five-minute recurring task with--tools exec.Technical Analysis
The skill directs the agent to install an Openclaw cron task that executes every five minutes and is granted access to the general-purpose shell execution tool. The task persists across sessions and continues operating after the conversation that created it has ended.
Individual watch tasks are documented as lasting seven days, but the cron task itself has no expiration, automatic removal procedure, or condition that disables it when no active watches remain. Consequently, a single confirmed watch can establish indefinite recurring agent execution.
Although polling is related to the advertised functionality, the use of a persistent scheduler with unrestricted
execcapability creates a durable execution channel with broader privileges and a longer lifetime than an individual watch requires.Attack Path
- A user asks the agent to create a freight-price watch.
- The user confirms the watch after reviewing its summary.
...[truncated 1010 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer authenticated server-side notifications or webhooks instead of installing a local recurring agent.
- If polling is unavoidable, use a constrained HTTP-only tool rather than granting the cron agent general shell execution through
--tools exec. - Associate the scheduler with active watch records and automatically remove or disable it when no active watches remain.
- Set an explicit maximum lifetime consistent with the documented seven-day watch duration.
- Require separate, explicit user or administrator approval before installing persistent infrastructure.
- Pin the destination origin and allowed API path so later configuration changes cannot repurpose the scheduler.
- Add administrative documentation covering task inventory, expiration, revocation, and removal.