T06 · System Persistence
- Location
scripts/openclaw-cron-vault-sync.sh:3- Finding
Persistent Environment-Controlled OpenClaw Scheduled Agent Task
- Content
View full analysis
Vulnerability Details
File Location:
scripts/openclaw-cron-vault-sync.sh, lines 3-18
Vulnerability Type: Persistent scheduled task with an environment-controlled Agent instruction
Risk Level: MediumVulnerable Code
bash TZ="${OBSIDIAN_CRON_TZ:-Asia/Shanghai}" NAME="${OBSIDIAN_CRON_NAME:-obsidian-vault-sync}" EXPR="${OBSIDIAN_CRON_EXPR:-0 */2 * * *}" MSG="${OBSIDIAN_CRON_MESSAGE:-按 obsidian-git-vault skill：对默认/当前 vault 执行 scripts/vault-sync.sh（先 resolve）；失败则报告并停止；强推仅当已接受 SOP 且 OBSIDIAN_SOP_FORCE_LEASE=1。}" if ! command -v openclaw >/dev/null 2>&1; then echo "未找到 openclaw 命令，跳过 cron 注册。" >&2 exit 1 fi openclaw cron add \ --name "$NAME" \ --cron "$EXPR" \ --tz "$TZ" \ --session isolated \ --message "$MSG"Related workflow documentation appears in
vault-sync-sop.md, lines 8-30, and requires written user consent before registration.Technical Analysis
The script calls
openclaw cron addto install a recurring task that remains active beyond the current Skill execution. By default, it starts an isolated OpenClaw session approximately every two hours. This is a cross-session persistence mechanism and therefore falls under system persistence, even though scheduled synchronization is part of the declared optional functionality.The schedule, task name, time zone, and—most importantly—the future Agent instruction are accepted from environment variables. An actor capable of influencing
OBSIDIAN_CRON_MESSAGEwhen the setup script is invoked can persist an alternative instruction for execution in later Agent sessions. The task is not itself a conventional shell backdoor, but its stored message can direct future Agent activity within the permissions available to those sessions.The surrounding documentation materially reduces the likelihood of unauthorized installation: it requires prior written user consent, limits setup to environments with ...[truncated 2370 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not register the task automatically. Print the fully resolved
openclaw cron addcommand and require the user to review and execute it manually. - Remove support for arbitrary
OBSIDIAN_CRON_MESSAGEvalues. Use a fixed, narrowly scoped synchronization instruction maintained in the reviewed Skill package. - If customization is necessary, restrict it to an allowlisted set of synchronization options rather than accepting free-form Agent instructions.
- Display the exact task name, schedule, time zone, target vault, remote destination, and stored message, then require explicit final confirmation immediately before registration.
- Validate the cron expression and enforce a safe minimum interval to prevent unexpectedly frequent execution.
- Add explicit task inspection, disablement, and removal commands to the setup output and documentation.
- Prefer a task with an expiration time or bounded execution count where OpenClaw supports those controls.
- Ensure scheduled sessions run with the minimum filesystem and network privileges required for the selected vault and configured Git remote.
- Preserve the existing requirement for prior written user consent and make it an enforceable setup step rather than a documentation-only safeguard.
- Do not register the task automatically. Print the fully resolved