System Maintenance

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:50 AM UTC
• Version: 1.3.2

Overview

This maintenance skill is purpose-related but packaged and documented in a way that could create persistent scheduled execution and broad cleanup behavior without enough scoping or safety controls.

Review before installing. Do not run the one-click setup or install-cron command unless the missing scripts are supplied and audited, the cron target is validated, and there is a clear uninstall path. Prefer a version that uses dry-run cleanup, explicit confirmation for persistence, safe crontab writing, and complete packaged scripts.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: entry.js:75
• Finding: Persistent Scheduled Task Installed Through the User Crontab<![CDATA[ ## Vulnerability Details **File Location**: `entry.js:75-100` **Vulnerability Type**: Persistent scheduled-task registration **Risk Level**: High ### Vulnerable Code ```js installCronJob() { console.log('⏰ 安装定时维护任务...'); const cronLine = '30 3 * * * ~/.openclaw/skills/system-maintenance/scripts/daily-maintenance-optimization.sh >> /tmp/openclaw-maintenance.log 2>&1'; try { // 获取当前 crontab let currentCron = ''; try { currentCron = execSync('crontab -l 2>/dev/null', { encoding: 'utf8' }); } catch { currentCron = ''; } // 检查是否已存在 if (currentCron.includes('daily-maintenance-optimization.sh')) { console.log('ℹ️ 定时任务已存在'); return; } // 添加新任务 const newCron = currentCron + '\n' + cronLine + '\n'; execSync(`echo "${newCron.trim()}" | crontab -`); console.log('✅ 定时任务安装完成 (每天 3:30)'); } catch (error) { console.error('❌ 定时任务安装失败:', error.message); } } ``` ### Technical Analysis The `install-cron` command modifies the invoking user's persistent crontab. The resulting task executes `daily-maintenance-optimization.sh` every day at 03:30 and survives termination of the Skill process, logout, and subsequent sessions. Scheduled automation is related to the declared maintenance functionality and is exposed as an explicit CLI command rather than silently installed. Nevertheless, persistent scheduler modification exceeds the privileges necessary for the Skill's on-demand cleanup and status-check operations. The implementation does not display the exact proposed change, obtain informed confirmation, validate the executable target, or provide a corresponding removal operation. The cron entry references a file that is absent from the audited artifact. If a file is subsequently created or replaced at that location, cron will execute it automatically with the installing user's privileges. ### Attack Path 1. A user invokes `node entry.js install-cron`. 2. The Skill reads t ...[truncated 934 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Keep scheduled automation disabled by default. - Before installation, display the exact cron entry and require explicit user confirmation. - Verify that the target script exists, is a regular file, is owned by the expected user, is not writable by untrusted users, and matches a trusted integrity hash. - Resolve and use an absolute script path rather than relying on `~` expansion. - Provide an idempotent `uninstall-cron` command that removes only entries managed by this Skill. - Mark managed entries with unique begin/end comments instead of identifying them by a broad substring. - Back up the existing crontab and restore it if installation fails. - Warn against installing the task from a privileged account unless privileged execution is strictly required. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: entry.js:82
• Finding: Shell Command Injection Through Existing Crontab Content<![CDATA[ ## Vulnerability Details **File Location**: `entry.js:82-98` **Vulnerability Type**: Shell command injection and unsafe crontab replacement **Risk Level**: High ### Vulnerable Code ```js // 获取当前 crontab let currentCron = ''; try { currentCron = execSync('crontab -l 2>/dev/null', { encoding: 'utf8' }); } catch { currentCron = ''; } // 检查是否已存在 if (currentCron.includes('daily-maintenance-optimization.sh')) { console.log('ℹ️ 定时任务已存在'); return; } // 添加新任务 const newCron = currentCron + '\n' + cronLine + '\n'; execSync(`echo "${newCron.trim()}" | crontab -`); ``` ### Technical Analysis The complete existing crontab is interpolated into a double-quoted shell command passed to `execSync`. Double quotes do not neutralize all shell syntax. Command substitutions using `$(...)` or backticks remain active, while embedded quotes, backslashes, dollar signs, and implementation-specific `echo` behavior can modify the resulting command or output. Consequently, content that is harmless while stored as a crontab line may be interpreted a second time by the shell when `installCronJob()` constructs its `echo` command. The implementation also replaces the entire crontab in one operation without preserving it safely or verifying that the resulting content is equivalent to the original plus the intended entry. ### Attack Path 1. An attacker, compromised local process, or previously installed software inserts shell substitution syntax into the affected user's crontab. 2. The user invokes `node entry.js install-cron`. 3. `crontab -l` returns the crafted text. 4. The text is inserted directly into ``execSync(`echo "${newCron.trim()}" | crontab -`)``. 5. The system shell parses command substitutions or malformed quoting. 6. The injected command executes with the privileges of the user running the Skill. 7. Depending on the payload, the user's existing crontab may also be corrupted or replaced. ### Impact Assessment Successful exploitation permits arbitrary shell ...[truncated 410 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Do not interpolate crontab data into a shell command. Pass the generated content directly to the `crontab` process through standard input: ```js const { spawnSync } = require('child_process'); const result = spawnSync('crontab', ['-'], { input: newCron, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }); if (result.status !== 0) { throw new Error(result.stderr || 'Unable to install crontab'); } ``` Additional hardening should include: - Preserve an exact backup of the original crontab before making changes. - Avoid `echo` for arbitrary structured content. - Use unique managed-entry markers and modify only the Skill-owned block. - Reject NUL bytes and malformed cron records. - Verify the installed crontab after writing it. - Restore the backup automatically if validation or installation fails. - Add tests containing quotes, backticks, `$()`, backslashes, percent signs, and multiline crontab commands. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: entry.js:17
• Finding: Persistent and Direct Execution Targets Are Missing from the Distributed Artifact<![CDATA[ ## Vulnerability Details **File Location**: `entry.js:17-20` **Vulnerability Type**: Unverified execution target and incomplete package contents **Risk Level**: Medium ### Vulnerable Code ```js runDailyMaintenance() { console.log('🚀 开始日常维护优化...'); const scriptPath = path.join(this.scriptsDir, 'daily-maintenance-optimization.sh'); try { execSync(`bash "${scriptPath}"`, { stdio: 'inherit' }); ``` Related persistent target at `entry.js:77`: ```js const cronLine = '30 3 * * * ~/.openclaw/skills/system-maintenance/scripts/daily-maintenance-optimization.sh >> /tmp/openclaw-maintenance.log 2>&1'; ``` Related installation target at `entry.js:151-160`: ```js const installScript = path.join(__dirname, 'maintenance-system', 'scripts', 'install-maintenance-system.sh'); if (!fs.existsSync(installScript)) { console.log('❌ 安装脚本不存在，请先更新技能'); return; } try { execSync(`bash "${installScript}"`, { stdio: 'inherit' }); ``` ### Technical Analysis The supplied project contains only `SKILL.md`, `entry.js`, and `package.json`. It does not contain the referenced `scripts/` or `maintenance-system/` directories. The documented maintenance implementation, installation logic, and persistent cron payload therefore cannot be reviewed and will not operate as packaged. The daily operation and cron task reference `daily-maintenance-optimization.sh`, while the documentation describes `daily-maintenance.sh`. This mismatch makes the effective execution target ambiguous. The cron installer does not verify target existence, ownership, permissions, file type, or integrity before registering persistence. Because cron resolves and executes the named location later, executable content created at that path after registration becomes the effective persistent payload. ### Attack Path 1. A user installs the cron entry even though the target script is absent. 2. The scheduled task remains registered and repeatedly references the missing path. 3. A later update, loca ...[truncated 895 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Include every executable referenced by the code and documentation in the reviewed package. - Use one consistent filename for the daily maintenance script. - Refuse to install cron unless the target exists and passes validation. - Resolve the target with `realpath` and reject symbolic links or paths outside the package. - Verify expected ownership and ensure the script is not group- or world-writable. - Distribute integrity hashes or signed release metadata for executable assets. - Remove documentation for components that are not included. - Add packaging tests that fail when any documented or executed file is absent. - Re-audit the missing shell scripts before distribution because their actual filesystem, service-control, and network behavior is unknown. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: entry.js:143
• Finding: Malformed Entry Point Prevents Safe Execution and Validation<![CDATA[ ## Vulnerability Details **File Location**: `entry.js:143-177` **Vulnerability Type**: Invalid program structure and missing module import **Risk Level**: Medium ### Vulnerable Code ```js module.exports = SystemMaintenanceSkill; /** * 安装统一维护系统 */ installUnifiedSystem() { console.log('🚀 安装统一维护系统...'); const installScript = path.join(__dirname, 'maintenance-system', 'scripts', 'install-maintenance-system.sh'); if (!fs.existsSync(installScript)) { console.log('❌ 安装脚本不存在，请先更新技能'); return; } try { execSync(`bash "${installScript}"`, { stdio: 'inherit' }); console.log('✅ 统一维护系统安装完成'); } catch (error) { console.error('❌ 安装失败:', error.message); } } /** * 检查统一系统状态 */ checkUnifiedSystem() { console.log('🔍 检查统一维护系统状态...'); const maintenanceDir = path.join(__dirname, 'maintenance-system'); if (!fs.existsSync(maintenanceDir)) { console.log('❌ 统一系统未安装'); return; } ``` ### Technical Analysis The `SystemMaintenanceSkill` class is closed before `module.exports`, but the later `installUnifiedSystem()` and `checkUnifiedSystem()` method declarations appear outside any class or object literal. A further unmatched closing brace appears later in the file. Node.js therefore cannot parse the module as distributed. Additionally, these methods reference `fs`, but the file imports only `child_process` and `path`. Even if the structural syntax were repaired, invoking these methods would throw a `ReferenceError` unless `fs` were imported. The file also contains two separate `require.main === module` command dispatchers, which would cause duplicate command handling after the syntax is corrected. ### Attack Path No direct attacker-controlled exploitation path is established from the audited files. The issue is triggered through normal use: 1. A user invokes `node entry.js` with any documented command. 2. Node.js parses the complete file bef ...[truncated 726 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Move `installUnifiedSystem()` and `checkUnifiedSystem()` inside the `SystemMaintenanceSkill` class. - Import the filesystem module explicitly: ```js const fs = require('fs'); ``` - Remove the duplicate CLI dispatcher and maintain a single command-routing block. - Run `node --check entry.js` as a mandatory build and release check. - Add automated tests that load the module and invoke every documented command. - Ensure command failures produce a nonzero exit status rather than only logging an error. - Add linting and package-content validation to the release pipeline. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented behavior goes beyond a generic maintenance description into direct file deletion, crontab persistence, localhost probing, and execution of bash scripts, while also claiming cross-platform support despite Unix-specific mechanisms. That mismatch can mislead users and reviewers about the real risk profile, causing them to approve or run a skill that performs persistent and potentially destructive system changes.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

ed)
```bash
bunx clawhub@latest install system-maintenance
```

#### Method 2: GitHub Clone
```bash
git clone https://github.com/jazzqi/openclaw-system-maintenance.git \
  ~/.openclaw/skills/system-maintenance
cd ~/.openclaw/skills/system-maintenance
chmod +x scripts/*.sh
```

#### One-Click Setup
```bash
bash scripts/install-maintenance-system.sh
```

#### Verification
```bash
# Check cron tasks
crontab -l | grep -i openclaw

# Test monitoring
bash scripts/real-time-monitor.sh --test

# Quick health check
bash scripts/daily-maintenance.sh --quick-check
```

## 🏗️ Layer 3: Architecture & Components

### Maintenance Schedule

| Frequency | Task | Description | Script |
|-----------|------|-------------|--------|
| Every 5 min | Real-time Monitoring | Gateway monitoring & auto-recovery | `real-time-monitor.sh` |
| Daily 2:00 AM | Log Management | Log cleanup, rotation, compression | `log-management.sh` |
| Daily 3:30 AM | Daily Maintenance | Comprehensive cleanup & health checks | `

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

�');
    }
  }

  /**
   * 安装定时任务
   */
  installCronJob() {
    console.log('⏰ 安装定时维护任务...');
    
    const cronLine = '30 3 * * * ~/.openclaw/skills/system-maintenance/scripts/daily-maintenance-optimization.sh >> /tmp/openclaw-maintenance.log 2>&1';
    
    try {
      // 获取当前 crontab
      let currentCron = '';
      try {
        currentCron = execSync('crontab -l 2>/dev/null', { encoding: 'utf8' });
      } catch {
        currentCron = '';
      }

      // 检查是否已存在
      if (currentCron.includes('daily-maintenance-optimization.sh')) {
        console.log('ℹ️  定时任务已存在');
        return;
      }

      // 添加新任务
      const newCron = currentCron + '\n' + cronLine + '\n';
      execSync(`echo "${newCron.trim()}" | crontab -`);
      
      console.log('✅ 定时任务安装完成 (每天 3:30)');
    } catch (error) {
      console.error('❌ 定时任务安装失败:', error.message);
    }
  }
}

//

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and documents shell-driven installation and maintenance actions, but does not declare any explicit tool scope such as permissions or allowed-tools. This makes the operational capability less transparent to users and policy enforcement layers, increasing the chance that shell access is granted implicitly for state-changing actions like cron setup, cleanup, and restore.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The overview markets automated cleanup, auto-recovery, backup/rollback, and maintenance automation as benefits without clearly warning that these actions can alter services, remove files, or revert system state. In a skill intended to be executed by users or agents, omission of impact warnings increases the risk of unsafe execution and accidental disruption.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The one-click setup and recovery examples encourage immediate execution of installation and restore scripts without any warning about cron changes, file cleanup, service restarts, or rollback side effects. This lowers the barrier to running impactful commands blindly and makes accidental system modification more likely.

Session Persistence

Medium

• Category: Rogue Agent

Content

#### Verification
```bash
# Check cron tasks
crontab -l | grep -i openclaw

# Test monitoring
bash scripts/real-time-monitor.sh --test

• Confidence: 85% confidence
• Finding: The crontab-related documentation indicates persistence through scheduled execution, which is legitimate for maintenance but still a security-relevant capability because it survives the current session and can repeatedly execute privileged actions. In the context of a skill, undocumented or insufficiently bounded persistence increases risk if scripts are altered, misconfigured, or abused.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: Comments and CLI output throughout the file are written only in Chinese, including usage/help text shown to end users. There is no opt-in, language selection, or indication that this skill is intentionally limited to a Chinese-language audience.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The quick cleanup path deletes files from shared temporary directories using broad filename patterns without prompting or previewing affected files. Destructive filesystem operations in /tmp can remove data created by other tools or users and are risky when invoked as a maintenance shortcut.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill installs a persistent cron job that will continue executing maintenance code outside the immediate CLI invocation. Persistence is security-relevant because it creates ongoing code execution and log-writing behavior, and the manifest/entry-point framing does not clearly signal that the skill will modify the user's scheduled tasks.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: Adding cron-based persistence materially expands the capability of the skill from on-demand maintenance to autonomous recurring execution. In a security review, hidden or weakly justified persistence is dangerous because it can be abused to repeatedly run changed scripts later, even if the initial invocation seemed harmless.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The cron installation modifies the user's crontab, creating persistent scheduled execution, but the code does not present a strong user warning or require explicit acknowledgment of that persistence. Silent or weakly announced persistence is dangerous because users may not realize code will continue running daily.

Session Persistence

Medium

• Category: Rogue Agent

Content

// 获取当前 crontab
      let currentCron = '';
      try {
        currentCron = execSync('crontab -l 2>/dev/null', { encoding: 'utf8' });
      } catch {
        currentCron = '';
      }

• Confidence: 88% confidence
• Finding: Reading and then updating the user's crontab is a persistence mechanism: it establishes code execution across sessions and reboots without requiring the user to rerun the skill. In this context the persistence is not inherently malware, but it is still security-sensitive because any later change to the referenced script will be executed automatically.

Session Persistence

Medium

• Category: Rogue Agent

Content

// 检查定时任务
    try {
      const cronOutput = execSync('crontab -l | grep -i "openclaw.*maintenance"', { encoding: 'utf8' });
      console.log('⏰ 定时任务:');
      console.log(cronOutput);
    } catch {

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Intent-Code Divergence

Low

• Confidence: 77% confidence
• Finding: The top-level comment describes a simple entry point for invoking maintenance features, but the file later includes extra unified-system install/check routines and a second command-line interface block after the module export. This documentation understates and misrepresents the file's actual contents and intent.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: entry.js:22