T06 · System Persistence
Error
- Location
index.js:177- Finding
Persistent Weekly Task Installation Through User Crontab
- Content
View full analysis
> ~/.openclaw/logs/qwen-check.log 2>&1'; try { // Check whether it already exists const existingCron = execSync('crontab -l 2>/dev/null || echo ""', { encoding: 'utf-8' }); if (existingCron.includes('check-qwen-auth')) { return { success: true, alreadyExists: true, message: 'Monitoring task already exists' }; } // Add a new task const newCron = existingCron.trim() + '\n' + cronJob + '\n'; execSync(`echo '${newCron}' | crontab -`, { encoding: 'utf-8' }); return { success: true, alreadyExists: false, message: 'Monitoring task added', cronJob: cronJob }; } catch (error) { return { success: false, error: error.message }; } } ``` Related documentation also recommends commands such as: ```bash echo "0 9 * * 1 $(pwd)/scripts/check-qwen-auth.sh" | crontab - ``` ### Technical Analysis The `setup-monitoring` command modifies the current user's crontab and causes code from the installed Skill directory to run every Monday across login sessions and system restarts. This is a genuine persistence mechanism. Periodic monitoring is part of the declared feature set and the registration is user-triggered rather than silently performed during installation. Nevertheless, persistent execution is not required for the core OAuth-link extraction functionality and expands the Skill's execution lifetime and attack surface. If the installed script is subsequently modified or replaced, the modified code will automatically ...[truncated 1152 chars]- Remediation
View remediation