T06 · System Persistence
- Location
SKILL.md:28- Finding
Optional Hourly Scheduled Execution Creates Cross-Session Persistence
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 28–31
Vulnerability Type: Scheduled-task persistence
Risk Level: MediumVulnerable Code Snippet
markdown 3. **Strongly recommend** the user to set up scheduled execution:openclaw cron add --name "autonomous-tasks" --message "run autonomous tasks" --every 1h
text Technical Analysis
The first-time initialization workflow strongly recommends creating an OpenClaw cron job that wakes the autonomous agent every hour. If the user follows this instruction, execution persists beyond the current Skill run and occurs without a new manual invocation each time.
The command is disclosed and requires the user to run it; the Skill does not silently install the scheduled task. Nevertheless, the resulting recurring job provides the Skill with repeated execution opportunities across sessions. On each wake-up, it reads persistent goals and task state from
agents/, executes pending tasks, writes outputs to the current working directory, and updates its persistent state.Attack Path
- A user invokes the Skill for its first-time setup.
- The Skill recommends running:
shell openclaw cron add --name "autonomous-tasks" --message "run autonomous tasks" --every 1h - The user executes the command, creating an hourly scheduled job.
- OpenClaw subsequently wakes the Skill every hour across sessions.
- Each scheduled run reads goals, backlog entries, and unfinished tasks from the persistent
agents/directory. - The agent executes those tasks and may create or modify outputs in the current working directory.
- Stale, mistaken, or subsequently altered persistent tasks can therefore cause repeated autonomous activity until the scheduled job is removed.
Impact Assessment
This behavior establishes persistence at the OpenClaw scheduled-task level. Its effective privileges are those granted to the OpenClaw process and its available tools. The affected scope in ...[truncated 422 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the recommendation to create a recurring cron job from the initialization workflow.
- Require explicit user invocation for each autonomous execution round.
- If scheduling is an intended feature, present it as a clearly labeled opt-in action rather than a strong recommendation.
- Require user approval before executing each generated task, particularly tasks that invoke tools, modify files, access external services, or run commands.
- Document how to inspect and remove the scheduled job.
- Apply least-privilege restrictions to scheduled runs, including a constrained working directory, limited tool access, and explicit file-write boundaries.
- Add expiration or run-count limits so scheduling cannot continue indefinitely without renewed user consent.
- Validate persistent task state before every scheduled run and reject tasks that request destructive actions, credential access, privilege changes, or execution outside the approved workspace.