T06 · System Persistence
Error
- Location
- strategies/Main.md:461
- Finding
- Automatic Cross-Session Follow-Up Scheduling Without Explicit Consent<![CDATA[ ## Vulnerability Details **File Location**: `strategies/Main.md:461-466` **Vulnerability Type**: `T06: System Persistence` **Risk Level**: High ### Vulnerable Code ```markdown ### 10.3 Schedule Follow-Ups **Automatic**: - 14 days: "How's your agent evolving?" - 30 days: "Progress check — how's the growth path?" - 90 days: "Major milestone review" ``` Related automatic activation is also defined in `SKILL.md:88-94`: ```markdown ## Scheduled Mode (End of Day 7) ``` ```text IF 7 days since first activation: 1. Notify: "🎓 Congratulations! You've completed your 7-day OpenClaw journey!" 2. Offer graduation ceremony 3. Generate retrospective report 4. Plan next steps together ``` ### Technical Analysis The Skill instructs the hosting Agent to create automatic follow-up activity at 14, 30, and 90 days. It also defines an automatic scheduled activation after seven days. If the OpenClaw host translates these natural-language directives into scheduler jobs, the resulting behavior survives the current Skill invocation and executes in later sessions. The instructions do not require explicit user consent before scheduling, identify the scheduler or execution identity, define job expiration, provide a cancellation procedure, or restrict what data may be accessed during later callbacks. The package does not contain an executable scheduler implementation, so exploitation depends on the host honoring these scheduling instructions. Nevertheless, the Skill explicitly requests persistent, automatic behavior. ### Attack Path 1. A user activates the graduation Skill. 2. The Agent follows Step 10.3 and creates automatic 14-day, 30-day, and 90-day follow-up jobs. 3. The jobs persist after the original graduation interaction ends. 4. At the scheduled times, the host reactivates the Agent or sends notifications without a separate confirmation. 5. A later callback may access updated user state while generating a progress review. ### Impact Assessment If scheduling ...[truncated 517 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace automatic scheduling with a clearly presented opt-in prompt. 2. Display the exact execution dates, notification content, and data sources before requesting approval. 3. Require explicit confirmation for each scheduled job or for a clearly defined group of jobs. 4. Create jobs with the minimum available permissions and prohibit callbacks from reading workspace or session content unless separately authorized. 5. Provide commands to list and cancel all jobs created by the Skill. 6. Set automatic expiration after the final approved callback. 7. Record consent and the associated job identifiers for auditability. 8. If the platform cannot guarantee consent, cancellation, and least-privilege execution, remove the scheduling instructions entirely. ]]>