T06 · System Persistence
Error
- Location
CRONS.md:1- Finding
Autonomous Scheduled-Task Persistence
- Content
View full analysis
Vulnerability Details
File Location:
CRONS.md, lines 1-69
Vulnerability Type: Persistent autonomous cron-job installation
Risk Level: HighVulnerable Code
markdown # Acquisition Crons — Agent 7 crons autonomes. Lun-Ven sauf mention contraire. Agent configure ces crons lors du setup du skill. --- ## Format OpenClaw ```json { "cron": { "enabled": true, "jobs": [ { "name": "acquisition-daily-content", "cron": "0 8 * * 1-5", "message": "Exécute acquisition.content — publie le contenu du jour selon content_calendar.json. Twitter + LinkedIn. Adapte le sujet à l'actualité du moment si pertinent. Log engagement dans CONTENT_LEARNINGS.md immédiatement après chaque publication. Si un post génère un engagement notable, log dans HOOKS.md.", "model": "claude-sonnet-4-6", "session": "isolated" }, { "name": "acquisition-daily-email", "cron": "0 9 * * 1-5", "message": "Exécute acquisition.email — envoie le batch cold email du jour (max 50). Lis leads_enriched.json, prends les prospects non encore contactés, utilise le meilleur template selon TEMPLATES_PERF.md. Log immédiatement dans AUDIT.md et sent_log.json après chaque envoi.", "model": "claude-sonnet-4-6", "session": "isolated" }, { "name": "acquisition-qualify-inbox", "cron": "0 9,13,17 * * 1-5", "message": "Exécute acquisition.qualify — lit les nouvelles réponses Gmail depuis la dernière vérification. Classe chaque réponse : chaud / tiède / froid / désabonnement. Si lead chaud : notifie le principal sur Telegram immédiatement avec nom, message, et contexte. Log dans LESSONS.md si hook validé par une réponse positive. Log dans ERRORS.md si désabonnement ou réponse négative avec raison probable.", "model": "claude-haiku-4-5", "session": "isolated" }, ...[truncated 4756 chars]- Remediation
View remediation
Remediation Suggestions
- Do not register cron jobs automatically during general skill setup.
- Present every proposed job, schedule, data source, external action, and destination to the user before installation.
- Require explicit opt-in approval for each individual job and default every job to disabled.
- Separate read-only analysis jobs from jobs that publish, send messages, or modify external systems.
- Require per-campaign approval before enabling email, follow-up, LinkedIn, or content-publication jobs.
- Add an expiration timestamp and maximum-run count to every scheduled job.
- Provide a documented command that disables and removes every installed job and verify cleanup after uninstalling the skill.
- Pin and integrity-check all referenced scripts before each invocation.
- Validate and sanitize mutable input files before scheduled processing.
- Use dedicated least-privilege service identities instead of broadly authenticated browser sessions.
- Add recipient allowlists, send-rate ceilings, dry-run mode, and a mandatory approval queue for outbound communications.
- Prevent inbox messages, prospect content, and social posts from being treated as agent instructions.