T06 · System Persistence
Error
- Location
- references/advanced-patterns.md:70
- Finding
- Persistent Scheduled Transmission of Financial Summaries## Vulnerability Details **File Location**: `references/advanced-patterns.md`, lines 70–81 **Vulnerability Type**: T06: System Persistence **Risk Level**: High The skill provides instructions for installing a recurring OpenClaw cron task that reads local financial records, generates a profit-and-loss summary, and announces that summary to a configured Telegram chat. **Complete Vulnerable Code Snippet**: ```bash openclaw cron add \ --name "month-end-close" \ --cron "0 18 28-31 * *" \ --model "anthropic/claude-haiku-3-5" \ --session isolated \ --message "Check if today is the last day of the month. If yes, run the month-end close: generate P&L from finance/income-log.md and finance/expense-log.md, append to finance/monthly-summary.md, update finance-state.json, and send me a summary." \ --announce \ --to "[YOUR_TELEGRAM_CHAT_ID]" \ --tz "America/Chicago" ``` ### Technical Analysis The `openclaw cron add` command creates a scheduled task that persists beyond the current agent session. It executes between the 28th and 31st day of every month and checks whether it should perform the month-end close. The scheduled prompt explicitly directs the agent to: 1. Read `finance/income-log.md` and `finance/expense-log.md`. 2. Generate a profit-and-loss report. 3. Update local financial state. 4. Send a summary through the announcement destination specified by `--to`. The combination of `--announce` and `--to "[YOUR_TELEGRAM_CHAT_ID]"` establishes an external transmission channel for derived financial information. This behavior conflicts with the privacy representation in `SKILL.md` that financial data remains local and is not transmitted externally. The task runs in an isolated session, but isolation does not eliminate persistence or disclosure risk because the scheduled session is intentionally granted access to the financial files and an outbound messaging destination. Exploitation requires the us ...[truncated 1841 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `--announce` and `--to` from the automated month-end example so scheduled processing remains local by default. 2. Require explicit, informed user approval before each external transmission of financial information. 3. Clearly disclose that `openclaw cron add` creates a persistent cross-session task and document how to inspect, disable, and remove it. 4. Separate local report generation from external delivery. The scheduled task should create a local draft, while the user manually approves any subsequent send. 5. If external delivery is retained as an optional feature: - Validate and display the destination before registration. - Require confirmation that the destination is private and controlled by the user. - Minimize transmitted content and omit transaction-level details. - Apply access controls and encryption supported by the messaging platform. - Record when and where summaries are sent. - Provide a local opt-out and task-removal command. 6. Update the privacy documentation in `SKILL.md` so it accurately distinguishes local-only default behavior from optional external integrations. 7. Avoid granting the scheduled session access to unrelated workspace files and restrict it to the minimum financial files required for report generation.