T06 · System Persistence
Error
- Location
- SKILL.md:183
- Finding
- Persistent Scheduled Job Performs Unattended Real-Money Trading<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:183-208`, `SKILL.md:245-254`, and `SKILL.md:274-294` **Vulnerability Type**: Persistent scheduled execution of real mainnet financial transactions **Risk Level**: Critical ### Vulnerable Code ```markdown 2. Check whether the `1m-trade-auto-trader` cron job exists: - Run `openclaw cron list` to verify whether it still exists. - If it exists, ask the user to stop/remove it before creating a new one. - If the user confirms it should be removed and it is still present, attempt to remove it with `openclaw cron rm <task id>`, then re-run `openclaw cron list` to confirm it is gone. 3. Create a periodic workflow using the command below. `--session isolated` is fixed and must not be changed. The default interval is every 20 minutes (`*/20`); replace with `*/N` if needed. Send the trading report to the user. ``` ```bash openclaw cron add \ --name "1m-trade-auto-trader" \ --cron "*/20 * * * *" \ --session isolated \ --message "<Paste the FULL prompt from #### Workflow content through the end of the report template below; ...>" \ --timeoutSeconds 600 \ --announce \ --channel <channel e.g. telegram> \ --to "<user id>" ``` ```markdown ## Execution Guidelines - Evaluate the full market universe (scan multiple assets). Trades are determined by risk controls; 0 to multiple trades are allowed. - Output must be a trading report only (no executable code). Markdown tables/quotes are allowed. - Do not create or modify any files. - Only call existing skills. - Use real trading (not simulation). ``` ```markdown **Execution loop**: When triggered, execute the following steps in order. Avoid requesting intermediate confirmations; proceed with execution. #### 3. Execution (act) Based on the decision, use `1m-trade-dex` commands to trade. - Example (market long/short): call `market-order` - Example (close): compute exact position size and place the appropriate market order - Example (limit): cal ...[truncated 2412 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not create a persistent mainnet trading task by default. 2. Default all automated operation to Hyperliquid testnet or a non-executing recommendation mode. 3. Require a separate, explicit confirmation that displays: - The exact schedule. - Authorized assets. - Maximum order notional. - Maximum aggregate exposure. - Maximum leverage. - Maximum daily loss and drawdown. - Task expiration time. - Destination account and notification channel. 4. Require confirmation for every mainnet order unless the user has created a narrowly scoped, time-limited policy outside the LLM. 5. Add a mandatory expiration time and automatically remove the cron task when it expires. 6. Add a readily accessible kill switch and verify that task removal succeeded. 7. Use a restricted signing credential whose permissions and funding are limited to the approved strategy. 8. Enforce risk limits in deterministic code outside the model rather than relying on prompt instructions. 9. Record tamper-evident order and risk-control logs without recording secrets. 10. Reject execution when market data is stale, incomplete, inconsistent, or unavailable. ]]>