System Maintenance

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:50 AM UTC
• Version: 1.3.2

Overview

This maintenance skill is purpose-related but packaged and documented in a way that could create persistent scheduled execution and broad cleanup behavior without enough scoping or safety controls.

Review before installing. Do not run the one-click setup or install-cron command unless the missing scripts are supplied and audited, the cron target is validated, and there is a clear uninstall path. Prefer a version that uses dry-run cleanup, explicit confirmation for persistence, safe crontab writing, and complete packaged scripts.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: entry.js:75

Finding

Persistent Scheduled Task Installed Through the User Crontab

Content

View full analysis

> /tmp/openclaw-maintenance.log 2>&1'; try { // 获取当前 crontab let currentCron = ''; try { currentCron = execSync('crontab -l 2>/dev/null', { encoding: 'utf8' }); } catch { currentCron = ''; } // 检查是否已存在 if (currentCron.includes('daily-maintenance-optimization.sh')) { console.log('ℹ️ 定时任务已存在'); return; } // 添加新任务 const newCron = currentCron + '\n' + cronLine + '\n'; execSync(`echo "${newCron.trim()}" | crontab -`); console.log('✅ 定时任务安装完成 (每天 3:30)'); } catch (error) { console.error('❌ 定时任务安装失败:', error.message); } } ``` ### Technical Analysis The `install-cron` command modifies the invoking user's persistent crontab. The resulting task executes `daily-maintenance-optimization.sh` every day at 03:30 and survives termination of the Skill process, logout, and subsequent sessions. Scheduled automation is related to the declared maintenance functionality and is exposed as an explicit CLI command rather than silently installed. Nevertheless, persistent scheduler modification exceeds the privileges necessary for the Skill's on-demand cleanup and status-check operations. The implementation does not display the exact proposed change, obtain informed confirmation, validate the executable target, or provide a corresponding removal operation. The cron entry references a file that is absent from the audited artifact. If a file is subsequently created or replaced at that location, cron will execute it automatically with the installing user's privileges. ### Attack Path 1. A user invokes `node entry.js install-cron`. 2. The Skill reads t ...[truncated 934 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: entry.js:82

Finding

Shell Command Injection Through Existing Crontab Content

Content

View full analysis

/dev/null', { encoding: 'utf8' }); } catch { currentCron = ''; } // 检查是否已存在 if (currentCron.includes('daily-maintenance-optimization.sh')) { console.log('ℹ️ 定时任务已存在'); return; } // 添加新任务 const newCron = currentCron + '\n' + cronLine + '\n'; execSync(`echo "${newCron.trim()}" | crontab -`); ``` ### Technical Analysis The complete existing crontab is interpolated into a double-quoted shell command passed to `execSync`. Double quotes do not neutralize all shell syntax. Command substitutions using `$(...)` or backticks remain active, while embedded quotes, backslashes, dollar signs, and implementation-specific `echo` behavior can modify the resulting command or output. Consequently, content that is harmless while stored as a crontab line may be interpreted a second time by the shell when `installCronJob()` constructs its `echo` command. The implementation also replaces the entire crontab in one operation without preserving it safely or verifying that the resulting content is equivalent to the original plus the intended entry. ### Attack Path 1. An attacker, compromised local process, or previously installed software inserts shell substitution syntax into the affected user's crontab. 2. The user invokes `node entry.js install-cron`. 3. `crontab -l` returns the crafted text. 4. The text is inserted directly into ``execSync(`echo "${newCron.trim()}" | crontab -`)``. 5. The system shell parses command substitutions or malformed quoting. 6. The injected command executes with the privileges of the user running the Skill. 7. Depending on the payload, the user's existing crontab may also be corrupted or replaced. ### Impact Assessment Successful exploitation permits arbitrary shell ...[truncated 410 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: entry.js:17

Finding

Persistent and Direct Execution Targets Are Missing from the Distributed Artifact

Content

View full analysis

> /tmp/openclaw-maintenance.log 2>&1'; ``` Related installation target at `entry.js:151-160`: ```js const installScript = path.join(__dirname, 'maintenance-system', 'scripts', 'install-maintenance-system.sh'); if (!fs.existsSync(installScript)) { console.log('❌ 安装脚本不存在，请先更新技能'); return; } try { execSync(`bash "${installScript}"`, { stdio: 'inherit' }); ``` ### Technical Analysis The supplied project contains only `SKILL.md`, `entry.js`, and `package.json`. It does not contain the referenced `scripts/` or `maintenance-system/` directories. The documented maintenance implementation, installation logic, and persistent cron payload therefore cannot be reviewed and will not operate as packaged. The daily operation and cron task reference `daily-maintenance-optimization.sh`, while the documentation describes `daily-maintenance.sh`. This mismatch makes the effective execution target ambiguous. The cron installer does not verify target existence, ownership, permissions, file type, or integrity before registering persistence. Because cron resolves and executes the named location later, executable content created at that path after registration becomes the effective persistent payload. ### Attack Path 1. A user installs the cron entry even though the target script is absent. 2. The scheduled task remains registered and repeatedly references the missing path. 3. A later update, loca ...[truncated 895 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: entry.js:143

Finding

Malformed Entry Point Prevents Safe Execution and Validation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented behavior goes beyond a generic maintenance description into direct file deletion, crontab persistence, localhost probing, and execution of bash scripts, while also claiming cross-platform support despite Unix-specific mechanisms. That mismatch can mislead users and reviewers about the real risk profile, causing them to approve or run a skill that performs persistent and potentially destructive system changes.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

ed)

bash

bunx clawhub@latest install system-maintenance

Method 2: GitHub Clone

bash

git clone https://github.com/jazzqi/openclaw-system-maintenance.git \
  ~/.openclaw/skills/system-maintenance
cd ~/.openclaw/skills/system-maintenance
chmod +x scripts/*.sh

One-Click Setup

bash

bash scripts/install-maintenance-system.sh

Verification

bash

# Check cron tasks
crontab -l | grep -i openclaw

# Test monitoring
bash scripts/real-time-monitor.sh --test

# Quick health check
bash scripts/daily-maintenance.sh --quick-check

🏗️ Layer 3: Architecture & Components

Maintenance Schedule

Frequency	Task	Description	Script
Every 5 min	Real-time Monitoring	Gateway monitoring & auto-recovery	real-time-monitor.sh
Daily 2:00 AM	Log Management	Log cleanup, rotation, compression	log-management.sh
Daily 3:30 AM	Daily Maintenance	Comprehensive cleanup & health checks	`

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · entry.js (reported line 85)May include surrounding context.

js

�');
    }
  }

  /**
   * 安装定时任务
   */
  installCronJob() {
    console.log('⏰ 安装定时维护任务...');
    
    const cronLine = '30 3 * * * ~/.openclaw/skills/system-maintenance/scripts/daily-maintenance-optimization.sh >> /tmp/openclaw-maintenance.log 2>&1';
    
    try {
      // 获取当前 crontab
      let currentCron = '';
      try {
        currentCron = execSync('crontab -l 2>/dev/null', { encoding: 'utf8' });
      } catch {
        currentCron = '';
      }

      // 检查是否已存在
      if (currentCron.includes('daily-maintenance-optimization.sh')) {
        console.log('ℹ️  定时任务已存在');
        return;
      }

      // 添加新任务
      const newCron = currentCron + '\n' + cronLine + '\n';
      execSync(`echo "${newCron.trim()}" | crontab -`);
      
      console.log('✅ 定时任务安装完成 (每天 3:30)');
    } catch (error) {
      console.error('❌ 定时任务安装失败:', error.message);
    }
  }
}

//

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises and documents shell-driven installation and maintenance actions, but does not declare any explicit tool scope such as permissions or allowed-tools. This makes the operational capability less transparent to users and policy enforcement layers, increasing the chance that shell access is granted implicitly for state-changing actions like cron setup, cleanup, and restore.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The overview markets automated cleanup, auto-recovery, backup/rollback, and maintenance automation as benefits without clearly warning that these actions can alter services, remove files, or revert system state. In a skill intended to be executed by users or agents, omission of impact warnings increases the risk of unsafe execution and accidental disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The one-click setup and recovery examples encourage immediate execution of installation and restore scripts without any warning about cron changes, file cleanup, service restarts, or rollback side effects. This lowers the barrier to running impactful commands blindly and makes accidental system modification more likely.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The crontab-related documentation indicates persistence through scheduled execution, which is legitimate for maintenance but still a security-relevant capability because it survives the current session and can repeatedly execute privileged actions. In the context of a skill, undocumented or insufficiently bounded persistence increases risk if scripts are altered, misconfigured, or abused.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Verification

bash

# Check cron tasks
crontab -l | grep -i openclaw

# Test monitoring
bash scripts/real-time-monitor.sh --test

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Comments and CLI output throughout the file are written only in Chinese, including usage/help text shown to end users. There is no opt-in, language selection, or indication that this skill is intentionally limited to a Chinese-language audience.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The quick cleanup path deletes files from shared temporary directories using broad filename patterns without prompting or previewing affected files. Destructive filesystem operations in /tmp can remove data created by other tools or users and are risky when invoked as a maintenance shortcut.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill installs a persistent cron job that will continue executing maintenance code outside the immediate CLI invocation. Persistence is security-relevant because it creates ongoing code execution and log-writing behavior, and the manifest/entry-point framing does not clearly signal that the skill will modify the user's scheduled tasks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

Adding cron-based persistence materially expands the capability of the skill from on-demand maintenance to autonomous recurring execution. In a security review, hidden or weakly justified persistence is dangerous because it can be abused to repeatedly run changed scripts later, even if the initial invocation seemed harmless.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The cron installation modifies the user's crontab, creating persistent scheduled execution, but the code does not present a strong user warning or require explicit acknowledgment of that persistence. Silent or weakly announced persistence is dangerous because users may not realize code will continue running daily.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Reading and then updating the user's crontab is a persistence mechanism: it establishes code execution across sessions and reboots without requiring the user to rerun the skill. In this context the persistence is not inherently malware, but it is still security-sensitive because any later change to the referenced script will be executed automatically.

Content

Scanner excerpt · entry.js (reported line 85)May include surrounding context.

js

// 获取当前 crontab
      let currentCron = '';
      try {
        currentCron = execSync('crontab -l 2>/dev/null', { encoding: 'utf8' });
      } catch {
        currentCron = '';
      }

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · entry.js (reported line 191)May include surrounding context.

js

// 检查定时任务
    try {
      const cronOutput = execSync('crontab -l | grep -i "openclaw.*maintenance"', { encoding: 'utf8' });
      console.log('⏰ 定时任务:');
      console.log(cronOutput);
    } catch {

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The top-level comment describes a simple entry point for invoking maintenance features, but the file later includes extra unified-system install/check routines and a second command-line interface block after the module export. This documentation understates and misrepresents the file's actual contents and intent.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: entry.js:22