T06 · System Persistence
Error
- Location
SKILL.md:78- Finding
Persistent OS-Level Scheduled Task Registration
- Content
View full analysis
- Remediation
View remediation
Security audit
AI News Pro
Security checks for vulnerabilities and agentic risk
Overview
This AI news skill is mostly coherent, but it includes optional OS-level scheduled tasks that can keep running and sending reports without clear removal or re-consent guidance.
Review the scheduled-push section before installing. On-demand use appears aligned with the skill's purpose, but only enable cron or Windows Task Scheduler entries if you want recurring unattended OpenClaw runs, have verified the message destination, and know how to disable the task later.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
Claw 外部配置 cron 任务：
前提说明：
- 本技能不内置、不存储任何渠道凭据。
- 如需推送，需在 OpenClaw 中预先配置
message工具及渠道凭据。 - 若未配置
message或渠道凭据，则仅输出报告，不执行推送。
推荐时间:
- 早报: 每日 12:00
- 晚报: 每日 22:00
- 热点: 每日 18:00
示例配置:
bash # Linux/macOS crontab 0 12 * * * openclaw agent --message "查询 AI 早报" 0 18 * * * openclaw agent --message "查询 24H 热点新闻榜" 0 22 * * * openclaw agent --message "查询 AI 晚报"Windows 任务计划程序:
powershell # 创建每日 12:00 早报任务 schtasks /create /tn "AI-News-Pro早报" /tr "openclaw agent --message '查询 AI 早报'" /sc daily /st 12:00🎯 数据源配置
当前启用信源
源 URL 类型 说明 MetaEra AI 快讯 https://agent.me.news/skill/flash/list?page=1&size=20&category=ai API AI 分类快讯流
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill advertises optional push delivery through external messaging channels without a clear user-facing warning that generated reports will leave the local agent context and be transmitted to third-party services. This creates a real risk of unintentional data disclosure, especially if the report content later includes sensitive prompts, internal links, or organization-specific intelligence.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The scheduling examples automate recurring message delivery to configured channels, but they do not clearly warn users that this may continuously transmit report contents to external systems without per-run review. In practice, that increases the chance of repeated unintended disclosure and makes misconfiguration more damaging over time.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown template explicitly requires output in Chinese via labels such as '输出格式' and Chinese-only placeholders, and further states the format must be followed strictly. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the restriction is clearly justified.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill first defines four invocation phrases, then adds an extra phrase at L024 ("生成 AI 日报") and a conversational variant at L035 ("帮我查询 AI 早报") without clarifying whether these are exhaustive examples or open-ended aliases. This ambiguity can broaden activation beyond the tightly scoped trigger list and makes it less clear when the skill should or should not activate.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file uses Chinese throughout key labels and instructions, such as source scopes and execution requirements, but does not state that the skill is Chinese-language only or offer any language/locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content