ClawHub
Back to skill

Security audit

Scheduled Tasks | 定时任务

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent scheduled-task helper, but users should be careful because its examples can create persistent jobs and send Feishu messages.

Install only if you intend to create scheduled OpenClaw or crontab jobs. Review every cron expression, recipient ID, message body, and job ID before running examples, and avoid sending sensitive content through Feishu unless that is intended.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
There is a material description-behavior mismatch. The description emphasizes creating and managing scheduled tasks and supporting system crontab management, but the code chunk only provides inspection, testing, history viewing, and environment health checks. It neither creates nor updates OpenClaw cron jobs or system crontab entries. While listing and checking tasks are adjacent to 'management,' the primary declared capability—task creation/management—is absent from the actual code, and the script adds undeclared operational diagnostics.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Content
---
name: scheduled-tasks
version: 2.1.7
description: >
  Create and manage OpenClaw scheduled tasks (reminders, periodic notifications, automated workflows).
  创建和管理 OpenClaw 定时任务（提醒、定时推送、自动化工作流）。
  Supports OpenClaw Cron API and system crontab with best practices and pitfall avoidance.
  支持 OpenClaw Cron API 和系统 crontab，包含最佳实践和避坑指南。
---

# Scheduled Tasks Skill | 定时任务技能

> **OpenClaw + 飞书定时任务解决方案**  
> **Version | 版本**: 2.1.7  
> **Author | 作者**: 9527  
> **License | 许可证**: MIT  

---

## Overview | 概述

This skill helps you create, manage, and troubleshoot scheduled tasks in OpenClaw. It supports two approaches: **OpenClaw Cron API** (recommended for Agent tasks) and **System Crontab** (for shell scripts).

本技能帮助您创建、管理
Confidence
75% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Credential Access

High
Category
Privilege Escalation
Content
# ✅ DO: Store credentials in your own environment config | 凭证存于您自己的环境配置
# ✅ DO: Use environment variables in scripts | 脚本中使用环境变量
# ❌ DON'T: Hardcode tokens in scripts | 脚本中硬编码 token
# ❌ DON'T: Put .env in skill package | 技能包中不放.env
```

---
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README includes an example that schedules automatic outbound Feishu messages containing task content and recipient identifiers, but it does not warn users that data will be transmitted to an external messaging platform. In a scheduling skill, this omission can lead to accidental disclosure of reminders, workflow outputs, or user identifiers to unintended recipients or external systems.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
Multiple examples and troubleshooting guidance assume `Asia/Shanghai` as the default timezone, which effectively forces a locale-specific setting in natural-language guidance. The policy allows locale constraints only when users are given a choice or the regional restriction is clearly documented and justified.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
# Edit crontab | 编辑 crontab
crontab -e

# Add line (daily at 16:00 | 每天 16:00)
0 16 * * * /path/to/scripts/daily-task.sh >> /tmp/task-name.log 2>&1
Confidence
85% confidence
Finding
The skill instructs users to persist scheduled execution via system `crontab`, which creates durable automation outside the immediate session. In this context that persistence is the feature, not malware, but it still has security implications because scheduled commands can continue running with user privileges, generate repeated outbound messages, or execute modified scripts long after initial setup.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The text states `中国用户必须指定时区` and hardcodes `Asia/Shanghai`, which is a natural-language locale policy constraint. This is framed as a blanket requirement rather than an opt-in preference or a clearly scoped region-specific instruction, so it can violate the policy against forcing a locale without user choice.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
User-facing comments and output strings are presented in Chinese throughout the script, and there is no indication that users can select another language or that the skill is intended only for a Chinese-speaking or region-specific environment. This creates a natural-language policy concern because the skill imposes a locale/language choice without user opt-in.

Session Persistence

Medium
Category
Rogue Agent
Content
openclaw cron list 2>&1
        echo ""
        echo "📋 系统 Crontab："
        crontab -l 2>/dev/null || echo "(无)"
        ;;

    test)
Confidence
85% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
openclaw cron list 2>&1
        echo ""
        echo "📋 系统 Crontab："
        crontab -l 2>/dev/null || echo "(无)"
        ;;

    test)
Confidence
85% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
openclaw cron list 2>&1
        echo ""
        echo "📋 系统 Crontab："
        crontab -l 2>/dev/null || echo "(无)"
        ;;

    test)
Confidence
85% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Low
Confidence
80% confidence
Finding
The example hard-codes the timezone `Asia/Shanghai`, and the task names/messages are presented only in Chinese, which suggests a locale-specific default. Because the document does not explain that this skill is China-specific or offer alternatives, this can be read as an implicit language/locale constraint without user opt-in.

Missing User Warnings

Low
Confidence
80% confidence
Finding
The markdown includes `openclaw cron remove <jobId>` as a basic command, but does not warn that it deletes an existing scheduled task and may remove configuration the user intended to keep. For markdown files, destructive or user-data-affecting behavior should be accompanied by a warning about impact.

Missing User Warnings

Low
Confidence
85% confidence
Finding
The markdown instructs the user to manually test message delivery with `openclaw agent --deliver` to a `user:<open_id>` target. Although this is operationally relevant, the section does not explicitly warn that the command will send a real outbound message to the specified recipient, which could affect user communications or privacy.

Natural-Language Policy Violations

Low
Confidence
88% confidence
Finding
This shell script contains user-facing comments and echoed messages in Chinese, but there is no indication that the skill is intended only for Chinese-speaking users or that language selection is optional. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.