ClawHub
Back to skill

Security audit

Daily Tech

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent daily technology news helper, but its optional Feishu schedule creates persistent recurring agent activity without enough lifecycle controls.

Install only if you want a recurring Feishu technology digest and are comfortable with a persistent OpenClaw cron job using the main agent. Before enabling, confirm the destination channel and know how to list and remove the cron job if notifications become unwanted.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T06 · System Persistence

Warning
Location
SKILL.md:128
Finding

Persistent Daily Agent Execution Through a Scheduled Task

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 128–140
Vulnerability Type: Persistent scheduled task creation
Risk Level: Medium

Vulnerable Code

bash
openclaw cron add \
  --name "每日科技推送" \
  --agent main \
  --message "今日科技" \
  --cron "0 7 * * *" \
  --tz "Asia/Shanghai" \
  --channel feishu

Technical Analysis

The skill instructs the agent to register a recurring OpenClaw cron job when the user requests scheduled technology updates. The job invokes the main agent every day at 07:00 in the Asia/Shanghai time zone and sends its output through the configured Feishu channel.

Because this task survives the original skill invocation and causes subsequent autonomous agent executions, it constitutes system persistence. Although task creation is tied to a user trigger, the skill does not require a final confirmation immediately before modifying persistent state. It also provides no expiration policy, duplicate-job detection, task-status inspection, or corresponding removal procedure.

An attacker cannot obtain new operating-system privileges from the documented command alone. However, a party capable of inducing an authorized user to issue the activation phrase could cause persistent executions under the existing permissions of the OpenClaw main agent and its configured Feishu integration.

Attack Path

  1. A user or socially engineered operator invokes the skill using the scheduled-delivery activation phrase.
  2. The skill executes openclaw cron add using the current OpenClaw environment.
  3. OpenClaw stores a persistent cron entry associated with the main agent.
  4. At 07:00 each day, the scheduler sends the configured message to that agent.
  5. The agent retrieves external news content and sends generated output through Feishu.
  6. Without an explicit removal workflow, the recurring execution continues across sessions. Repeated activation may also create duplicate jobs ...[truncated 831 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit confirmation immediately before creating the persistent task, showing the exact schedule, agent, message, time zone, and destination channel.
  2. Add a documented disable operation that removes the task by a stable identifier rather than relying only on its display name.
  3. Check for an existing task before creation and update or reject duplicates.
  4. Return the created task identifier and provide commands for inspecting, pausing, and deleting it.
  5. Support an expiration date or a bounded execution count, with indefinite scheduling requiring separate consent.
  6. Notify the user after creation and periodically disclose that the automation remains active.
  7. Validate the destination channel and use the least-privileged agent needed to retrieve and summarize public news.
  8. Handle scheduler failures safely and avoid automatically recreating deleted or disabled tasks without renewed authorization.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The trigger set includes broad natural phrases such as '今日科技' and '每日AI' that are plausible in ordinary conversation, increasing the chance of unintended activation. In this skill, accidental activation is more concerning because one of the advertised paths enables persistent scheduled messaging, so a casual phrase could lead users into side-effecting behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation states that saying '开启科技推送' will automatically push to Feishu every day at 07:00, but it does not prominently warn that this creates an ongoing recurring message. Lack of explicit notice and consent around persistent external notifications can surprise users and cause unwanted automation or spam in connected channels.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill includes instructions to create a persistent scheduled Feishu push via openclaw cron add, which changes the behavior from one-time content retrieval to ongoing automation affecting an external channel. That is security-relevant because it can generate recurring outbound messages and user-visible side effects beyond the immediate request, especially if users do not fully understand that activation persists daily.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The cron command directly provisions an automatic external push to Feishu without any surrounding disable guidance, confirmation flow, or lifecycle management instructions. This makes the skill more dangerous than a normal content skill because it can establish durable outbound behavior that persists after the initial interaction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The manifest description defines Chinese-only trigger phrases and presents the skill as a Chinese-language daily push, while also consuming mixed Chinese and English sources. There is no indication that the user may opt into another language or locale for invocation/output, which may conflict with organizational language-choice expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.