ClawHub
Back to skill

Security audit

Script Cron Jobs (no LLM)

Security checks for vulnerabilities and agentic risk

Overview

This skill openly implements scheduled shell scripts, but it installs persistent gateway startup code that auto-runs local scripts with the gateway user's privileges and inherited environment.

Install only if you intentionally want a persistent shell-script scheduler inside OpenClaw. Restrict write access to ~/.openclaw/cron-scripts and the hook directory, review every script before placing it there, avoid secrets in the gateway environment, and remove the hook if you no longer need scheduled execution.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T06 · System Persistence

Error
Location
hooks/cron-scripts-loader/handler.ts:64
Finding

Persistent Scheduled Execution of Arbitrary Shell Scripts

Content
View full analysis
{ if (!filename.endsWith(".sh")) return; const filePath = join(SCRIPTS_DIR, filename); try { await stat(filePath); } catch { return; } let content: string; try { content = await readFile(filePath, "utf8"); } catch (err: any) { console.error(`${LOG_PREFIX} Cannot read ${filename}: ${err.message}`); return; } const meta = parseMeta(content, filePath); if (!meta) return; stopJob(filename); try { const job = new Cron( meta.schedule, { timezone: meta.tz, protect: true }, () => { try { runScript(meta); } catch (err: any) { console.error(`${LOG_PREFIX}[${meta.name}] Unexpected run error: ${err.message}`); } } ); activeJobs.set(filename, job); ``` The directory watcher automatically activates newly created or modified scripts: ```ts function watchDir(): void { con ...[truncated 5189 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

Although the description mentions running bash scripts on a schedule, the documented behavior also includes persistent startup-hook registration, hot-reloaded filesystem watching, local API calls, and external notifications. That broader behavior increases risk because users may treat it as a simple cron helper when it actually introduces a long-lived code execution surface with network egress and implicit triggers.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
Copy `hooks/cron-scripts-loader/handler.ts` from this skill into your OpenClaw hooks directory:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill explicitly enables scheduled shell execution and environment access but does not declare any tool scope or permission boundaries. That creates hidden execution capability and makes review, policy enforcement, and least-privilege controls harder, especially because the scripts run automatically at gateway startup and thereafter on a schedule.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file encourages users to schedule arbitrary shell scripts for tasks like cleanup, git pulls, backups, and HTTP calls without prominently warning that these scripts execute automatically as the gateway user and can modify files or transmit data. In a persistence-oriented automation skill, omission of safety guidance materially increases the chance of unsafe deployment or abuse.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The installation instructions persist a hook under the user's OpenClaw hooks directory so it will execute on every gateway startup and continue watching a scripts directory for autonomous execution. This is a persistence mechanism by design; in security terms it creates a durable code execution foothold that can survive normal agent interactions and trigger without further user review.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Copy hooks/cron-scripts-loader/handler.ts from this skill into your OpenClaw hooks directory:

bash
mkdir -p ~/.openclaw/hooks/cron-scripts-loader
cp <skill-dir>/hooks/cron-scripts-loader/handler.ts \
   ~/.openclaw/hooks/cron-scripts-loader/handler.ts

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

bash
# Post to a Telegram user
curl -sf -X POST http://localhost:3000/api/announce \
  -H "Content-Type: application/json" \
  -d "{\"text\": \"Hello from script cron\", \"channel\": \"telegram\", \"to\": \"<YOUR_CHAT_ID>\"}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples/health-check.sh (reported line 17)May include surrounding context.

sh
HTTP_CODE=$(curl -sf -o /dev/null -w "%{http_code}" --max-time 10 "$URL" 2>/dev/null || echo "000")

if [ "$HTTP_CODE" != "200" ]; then
  curl -sf -X POST "http://localhost:${OPENCLAW_PORT}/api/announce" \
    -H "Content-Type: application/json" \
    -d "{\"text\": \"⚠️ Health check failed: $URL returned HTTP $HTTP_CODE\", \"channel\": \"telegram\", \"to\": \"$CHAT_ID\"}" \
    > /dev/null

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
hooks/cron-scripts-loader/handler.ts:63