T06 · System Persistence
Error
- Location
- scripts/bootstrap.sh:47
- Finding
- Persistent Third-Party Hooks and Scheduled Agent Tasks<![CDATA[ ## Vulnerability Details **File Location**: `scripts/bootstrap.sh`, lines 47-77 **Vulnerability Type**: Persistent hook and scheduled task installation **Risk Level**: High ### Vulnerable Code ```bash # --- 5. Hook --- if [ -d "$WORKSPACE/skills/self-improving-agent/hooks/openclaw" ] && [ ! -d "$HOME/.openclaw/hooks/self-improvement" ]; then cp -r "$WORKSPACE/skills/self-improving-agent/hooks/openclaw" "$HOME/.openclaw/hooks/self-improvement" openclaw hooks enable self-improvement 2>/dev/null && ok "self-improvement hook" || echo "⚠️ Hook enable failed" else skip "self-improvement hook" fi # --- 6. Cron --- CRONS=$(openclaw cron list --json 2>/dev/null | python3 -c "import sys,json; print(' '.join(j['name'] for j in json.load(sys.stdin).get('jobs',[])))" 2>/dev/null || echo "") add_cron() { local name="$1" cron="$2" timeout="$3" msg="$4" echo "$CRONS" | grep -q "$name" && skip "cron: $name" || { openclaw cron add --name "$name" --cron "$cron" --tz "Asia/Shanghai" --timeout-seconds "$timeout" --message "$msg" 2>/dev/null && ok "cron: $name" || echo "⚠️ cron: $name failed" } } add_cron "weekly-self-reflection" "0 22 * * 0" 600 \ "每周自省： 1. 读取 memory/ 本周日志 2. 更新 MEMORY.md 3. 写报告到 memory/reflection-本周.md 4. 回复 NO_REPLY" add_cron "monthly-learnings-review" "0 21 1 * *" 600 \ "月度学习回顾： 1. 扫描 .learnings/ 中 pending 高优先级条目 2. promote 到 AGENTS.md 或 MEMORY.md 3. 写报告到 memory/learnings-review-本月.md 4. 回复 NO_REPLY" ``` ### Technical Analysis The bootstrap copies a hook obtained from the separately installed `self-improving-agent` package into the persistent OpenClaw hook directory and enables it. It also registers two recurring Agent tasks that survive completion of the bootstrap process. The hook content is neither audited nor integrity-verified before activation. The scheduled tasks are authorized to read historical logs and modify persistent files, including `MEMORY.md` and `AGENTS.md`. Consequently, code or instructions i ...[truncated 1079 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Make hook and cron installation opt-in rather than part of the default bootstrap. - Display the exact hook source, requested capabilities, schedules, and file access before requesting explicit user approval. - Pin the installed package to a reviewed version and verify its cryptographic digest or signature. - Review and copy only an allowlisted set of hook files instead of recursively copying the downloaded directory. - Run persistent tasks with the minimum possible tool and filesystem permissions. - Prevent scheduled tasks from directly changing governing instruction files. - Provide documented rollback commands that disable and remove the hook and both cron jobs. - Preserve command errors rather than suppressing all diagnostic output with `2>/dev/null`. ]]>