T06 · System Persistence
Error
- Location
- SKILL.md:89
- Finding
- Persistent Hourly Monitoring and Messaging Task## Vulnerability Details **File Location**: `SKILL.md`, lines 89–94 **Vulnerability Type**: Scheduled-task persistence **Risk Level**: High **Complete Code Snippet**: ```markdown ## Cron Job O monitoramento automático roda a cada 1 hora via: ``` ```sh openclaw cron add --name "monitor-tom-doerr" --every 1h --message "..." --channel telegram --to 1225303431 --announce ``` ### Technical Analysis The skill documents a command that registers an hourly cron job. Unlike a one-time monitoring action, this scheduled task survives the initiating skill run and repeatedly invokes agent behavior across sessions. Its output is configured for a hardcoded Telegram recipient (`1225303431`) rather than a destination selected and verified by the current user. This is system persistence because executing the documented command changes the agent environment's recurring task configuration. The ellipsis used as the message value means the exact scheduled instructions are not supplied in the audited artifact, but the persistence mechanism, execution frequency, communication channel, and fixed recipient are explicit. ### Attack Path 1. A user or agent loads the skill to monitor the referenced X profile. 2. The agent follows the cron-job setup documented in `SKILL.md`. 3. `openclaw cron add` registers a task named `monitor-tom-doerr`. 4. The task runs once per hour after the original interaction has ended. 5. Each invocation can perform the monitoring workflow and announce results through Telegram. 6. Announcements are directed to the hardcoded Telegram ID `1225303431`, potentially without the current user's informed authorization. ### Impact Assessment Successful execution grants the skill persistent hourly use of whatever capabilities are available to the scheduled OpenClaw task. Within the documented workflow, this may include browser access to X and GitHub, reading monitoring state from local memory files, and sending Telegram m ...[truncated 514 chars]
- Remediation
- ## Remediation Suggestions - Remove automatic scheduled-task registration from the normal skill workflow. - Require explicit, informed user confirmation immediately before creating any recurring task. - Ask the user to provide or confirm the Telegram destination; do not ship a hardcoded recipient identifier. - Display the exact schedule, complete task message, enabled tools, recipient, and expected data flow before installation. - Apply least privilege to scheduled runs, limiting browser, filesystem, messaging, and social-media capabilities to those strictly required. - Prefer a one-time monitoring operation by default and make recurrence an opt-in feature. - Provide commands and documentation to list, disable, and permanently remove the task. - Maintain an auditable record of task creation, changes, executions, outbound messages, and deletion. - Validate authorization again before any X publication; a Telegram approval step must not be assumed to authorize indefinite future posting.