T06 · System Persistence
Error
- Location
- SKILL.md:225
- Finding
- Recurring External Disclosure of CRM Data Through a Persistent Scheduled Task<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 225–240 **Vulnerability Type**: Persistent scheduled task with recurring external processing and transmission of sensitive CRM information **Risk Level**: High ### Vulnerable Code ```bash openclaw cron add \ --name "weekly-crm-review" \ --cron "0 9 * * MON" \ --model "anthropic/claude-3-5-haiku-20241022" \ --session isolated \ --message "Read crm/pipeline.md and crm/follow-ups.md. Report: overdue follow-ups, pipeline value by stage, clients not touched in 30+ days, and deals with no movement in 14+ days. Be concise." \ --announce \ --to "[YOUR_TELEGRAM_CHAT_ID]" \ --tz "America/Chicago" ``` ### Technical Analysis The documented command installs a weekly OpenClaw scheduled task that survives the current skill run. On each execution, the task reads `crm/pipeline.md` and `crm/follow-ups.md`, processes their contents using the configured external model, and announces the resulting report to a Telegram destination. These CRM files can contain client identities, deal stages, monetary values, relationship activity, deadlines, and follow-up details. The command therefore establishes a recurring path from locally stored business records to external model-processing and messaging services. Although the automation is presented as optional and the destination is supplied by the user, the documentation does not place a clear disclosure warning beside the command, require per-run confirmation, recommend redaction, or provide instructions to inspect and remove the persistent task. This is also in tension with the privacy statement at `SKILL.md:306`, which emphasizes that CRM data remains local unless the user explicitly asks for it to be sent. Enabling the task constitutes a one-time authorization that can result in repeated future disclosures without additional confirmation. The scheduled task operates with whatever file access and outbound communication capabilities are available t ...[truncated 1836 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Default to a local, non-networked review that does not use `--announce`, `--to`, or an externally hosted model. 2. Place a prominent warning immediately before the command explaining: - Which files will be read - Which external services will process the data - Which information may be sent to Telegram - That the task will execute repeatedly without per-run confirmation 3. Require explicit informed consent before creating the scheduled task. 4. Prefer a one-time review command unless recurring execution is necessary. 5. Redact client names, contact details, interaction notes, and exact financial values before external processing or delivery. 6. Transmit only minimum necessary aggregates, such as counts by stage, where possible. 7. Validate the Telegram destination before scheduling recurring delivery and recommend a private, access-controlled destination. 8. Provide commands to list, inspect, disable, and permanently remove the scheduled task. 9. Recommend a dedicated least-privilege execution context restricted to the minimum required CRM files. 10. Update the privacy section to state clearly that enabling external models or Telegram delivery causes CRM information to leave the local workspace. 11. For users subject to contractual, legal, financial, or healthcare confidentiality requirements, recommend avoiding external processing unless an approved data-processing agreement and retention policy are in place. ]]>