T06 · System Persistence
Error
- Location
- SKILL.md:78
- Finding
- Persistent Agent Execution Through Scheduled Cron Jobs## Vulnerability Details **File Location**: `SKILL.md`, lines 78-86 **Vulnerability Type**: Scheduled-task persistence **Risk Level**: High ### Complete Code Snippet The following is an English translation of the documented instruction: ```markdown For recurring commitments with a fixed time, also register an OpenClaw cron job: openclaw cron add --name "daily-report-prep" --cron "50 17 * * 1-5" --message "Commitment Engine trigger: prepare work report C001. Immediately read commitments.md and execute C001." This ensures that cron triggers at the scheduled time even if the heartbeat misses the time window. ``` ### Technical Analysis The skill explicitly instructs the agent to create an OpenClaw cron job for fixed recurring commitments. Unlike an operation limited to the current interaction, a cron job survives the skill run and generates future agent messages automatically. The scheduled message directs the future agent session to read `commitments.md` and execute a ledger entry. Because commitment descriptions originate from user instructions and remain in persistent storage, this creates a durable execution path from stored content to a future agent invocation. The example uses a static command and therefore does not, by itself, demonstrate shell command injection. The security issue is the installation of a cross-session scheduled execution mechanism without an explicit approval, expiration, ownership validation, or cleanup requirement. ### Attack Path 1. A user or other accepted input source requests a recurring task with a fixed execution time. 2. The skill records the task in `workspace/commitments.md`. 3. Following the documented policy, the agent invokes `openclaw cron add`. 4. The resulting scheduled task survives the current skill invocation. 5. At the configured time, OpenClaw injects a message instructing the agent to read the persistent ledger. 6. The agent executes the referenced commitment in a l ...[truncated 771 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit, task-specific user confirmation immediately before every cron registration. 2. Display the exact schedule, stored message, task identifier, expiration time, and removal procedure before approval. 3. Apply an allowlist to scheduled actions and prohibit scheduled messages from directly authorizing high-impact tools. 4. Bind every scheduled job to an authenticated owner and immutable commitment identifier. 5. Add mandatory expiration dates and maximum recurrence limits. 6. Automatically remove the associated cron job when a commitment is completed, cancelled, failed permanently, or expires. 7. Revalidate authorization and task status at execution time rather than treating the scheduled message as authorization. 8. Maintain an auditable mapping between ledger entries and cron job identifiers. 9. Provide a command that lists and safely removes all jobs installed by the skill. 10. Run scheduled commitments with the minimum necessary tool permissions.