OpenClaw Cron Guardrails

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:03 AM UTC
• Version: 0.1.5

Overview

This skill is a disclosed OpenClaw cron helper, but it supports persistent scheduled agent actions including session prompt injection and has an unsafe shell-based apply path.

Install only if you intentionally need OpenClaw cron creation and repair helpers. Keep workflows in dry-run until reviewed, require explicit confirmation before --apply or cron edit/run actions, avoid untrusted natural-language input, and treat current-session/current-thread jobs, external channel delivery, and webhooks as privileged operations needing clear scope and trusted destinations.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad cron-management skill covering creation, review, repair, routing, natural-language scheduling, and explicit delivery/session controls. The supplied code is much narrower: it only audits existing cron jobs by running lint_existing_crons.py, classifies findings into warnings/errors, and optionally applies fixes for error cases via cron_fix.py. There is no logic for creating jobs, parsing natural-language requests, routing messages across channels/sessions/threads, or handling general openclaw cron add/edit/run workflows. While the code does partially align with the 'review/repair' portion of the description, the overall declared purpose materially overstates and misrepresents the actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied code only analyzes existing cron job definitions and reports warnings/errors about sessionTarget, payload kind, delivery configuration, timezone presence, timeout heuristics, and recent error strings. Its primary purpose is linting/reviewing existing jobs, not performing the broader operational workflow claimed in the description. The description substantially overstates capabilities such as creation, repair, routing, and execution of cron jobs, as well as natural-language handling. The only aligned portion is 'review' of cron jobs, especially around delivery/session routing safety in multi-channel setups.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence

Finding

The declared description presents a full operational cron-management skill, including creating, reviewing, repairing, routing, and handling OpenClaw cron workflows with explicit delivery/session routing. The supplied code chunk is much narrower: it reads text, applies regex/keyword heuristics, and emits a JSON interpretation plus diagnostics and a needs-review flag. While the parser does cover relevant concepts from the description—reminders, recurring jobs, session/thread targeting, delivery hints, and natural-language schedule parsing—it never actually performs the described management actions. This is a material description-behavior mismatch because the primary purpose implemented here is intent parsing/classification, not cron job creation, repair, routing, or execution.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This is a true tool-parameter abuse issue: the tool accepts a generated command and directly executes it in a shell, effectively turning renderer output into code. In the context of a cron-management skill, this is especially dangerous because an attacker may gain both immediate command execution during apply and persistence by creating malicious scheduled tasks.

Content

Scanner excerpt · scripts/create_cron.py (reported line 73)May include surrounding context.

python

print(json.dumps({"ok": True, "mode": "dry-run", "validation": validation, "render": rendered}, ensure_ascii=False, indent=2))
        raise SystemExit(0)

    proc = subprocess.run(command, shell=True, text=True, capture_output=True)
    result = {
        "ok": proc.returncode == 0,
        "mode": "apply",

Ssd 2

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The parser explicitly treats session-pushing and prompt-injection phrasing as a valid, normalized intent rather than rejecting or quarantining it. In a cron/scheduled-agent skill, this is dangerous because it legitimizes persistence and repeated delivery of adversarial prompts into the current session or thread, increasing the chance of context poisoning, policy bypass attempts, or unwanted autonomous actions over time.

Content

No source excerpt is available for this finding.

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

After identifying session-injection language, the code continues to infer schedule type, target scope, and delivery routing, effectively integrating the request into an execution workflow instead of blocking it. This is risky because a malicious or unsafe natural-language request can be transformed into a recurring job against the current session/thread, enabling repeated prompt injection or automated manipulation with limited safeguards.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill instructs the agent to read local reference files and invoke scripts/CLI workflows, which implies file and shell capabilities, but it does not declare any tool scope or permission boundaries. That increases the chance of over-privileged execution or accidental tool use outside the intended cron-guardrail purpose, especially because the skill covers create/edit/run operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation criteria are broad enough to trigger on common scheduling language, including repeated prompt injection into the current session/thread and generic reminder phrasing. In an agent environment, over-broad activation can cause the wrong skill to intercept routine requests and steer the model toward cron creation, session-targeting, or repeated message delivery without sufficiently narrow user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance is broad enough to trigger on generic natural-language scheduling phrases, including requests involving repeated prompt injection into the current session or thread. In an agentic system, over-broad routing can misclassify ordinary conversation as permission to create or alter scheduled actions, increasing the chance of unintended persistence, repeated actions, or misuse of session-aware delivery targets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file normalizes two risky behaviors in examples: scheduled prompt injection into the current session's agent and outbound posting to Discord. Even though this is documentation for a parser, the examples can directly shape implementation and user flows, and they present these actions without explicit warning, approval requirements, or safety constraints.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This example teaches the system to interpret a natural-language request for recurring prompt injection against the current session as a valid intent shape. In the context of a cron/scheduling guardrail skill, that is especially dangerous because it could operationalize persistent instruction tampering or repeated adversarial influence over an active agent session.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The usage example repeats the exact prompt-injection instruction and demonstrates how to feed it into the parser tool, which lowers the barrier to misuse. Because this skill is specifically meant to create and route scheduled actions, including a runnable example makes the dangerous behavior more actionable than a mere conceptual mention.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The webhook delivery pattern normalizes sending cron job output to an external HTTP endpoint without any caution about data classification, authentication, destination trust, or transport security assumptions. In a scheduling skill that may be used for summaries, analysis, or internal state publication, this creates a real risk of unintended data exfiltration or leakage to third-party systems if users copy the pattern blindly.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/create_cron.py (reported line 20)May include surrounding context.

python

def run_json(cmd: list[str], input_text: str | None = None):
    proc = subprocess.run(cmd, input=input_text, text=True, capture_output=True)
    return proc.returncode, proc.stdout, proc.stderr

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

The script executes a rendered command string with shell=True, which allows shell interpretation of any attacker-controlled content that survives validation/rendering. Because this skill creates cron jobs from natural-language or JSON specs in a multi-channel agent context, malformed fields could become arbitrary command execution on the host running the skill.

Content

Scanner excerpt · scripts/create_cron.py (reported line 73)May include surrounding context.

python

print(json.dumps({"ok": True, "mode": "dry-run", "validation": validation, "render": rendered}, ensure_ascii=False, indent=2))
        raise SystemExit(0)

    proc = subprocess.run(command, shell=True, text=True, capture_output=True)
    result = {
        "ok": proc.returncode == 0,
        "mode": "apply",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/cron_doctor.py (reported line 14)May include surrounding context.

python

def run(cmd: list[str]):
    proc = subprocess.run(cmd, text=True, capture_output=True)
    return {
        "cmd": cmd,
        "returncode": proc.returncode,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/cron_fix.py (reported line 11)May include surrounding context.

python

def run(cmd: list[str]):
    proc = subprocess.run(cmd, text=True, capture_output=True)
    return {
        "cmd": cmd,
        "returncode": proc.returncode,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/cron_fix.py (reported line 21)May include surrounding context.

python

def load_lint_results():
    proc = subprocess.run(
        [sys.executable, __file__.replace("cron_fix.py", "lint_existing_crons.py")],
        text=True,
        capture_output=True,

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

When scheduleType is "cron", the code silently replaces the requested schedule with the hard-coded expression */10 * * * *, while still returning an apparently valid cron spec. This can cause jobs to run far more often than intended or at unexpected times, which is especially dangerous in a scheduling skill that may generate autonomous agent actions and multi-channel deliveries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The transformer emits executable cron payloads with kind="agentTurn" for session-injection, repeat-loop, and scheduled-worker intents rather than limiting output to inert review metadata. In this skill context, that means natural-language input can be converted directly into scheduled autonomous agent actions, including repeated prompt injection into isolated sessions, which materially increases the risk of persistence, unintended automation, and abuse if upstream parsing or review is bypassed.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/lint_existing_crons.py (reported line 11)May include surrounding context.

python

def load_jobs(path_arg: str | None):
    if path_arg:
        return json.loads(Path(path_arg).read_text())
    proc = subprocess.run(
        ["openclaw", "cron", "list", "--all", "--json"],
        text=True,
        capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render_cron_command.py (reported line 35)May include surrounding context.

python

def run_validator(spec: dict):
    proc = subprocess.run(
        [sys.executable, str(VALIDATOR), "-"],
        input=json.dumps(spec),
        text=True,

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The document presents multiple recommended patterns using a specific locale/timezone, which can steer users toward a fixed regional setting without opt-in. Because this is guidance rather than a clearly justified region-specific tool, it should avoid implying a mandatory locale default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This scheduled Discord delivery example again fixes the timezone to America/New_York in a general-purpose pattern. Repeating a specific locale in default guidance may conflict with language/locale neutrality expectations unless the document explains that users should substitute their own timezone.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This pattern continues the use of a specific regional timezone in a generic recommendations document. Without an explicit opt-in or statement that the value is an example to be customized, it may be interpreted as forcing a locale-specific default.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.