T06 · System Persistence
Error
- Location
scripts/setup_cron.sh:7- Finding
Persistent and Non-Idempotent Cron Job Installation
- Content
View full analysis
/dev/null; echo "0 9 * * * cd /home/openclaw/workspace/skills/amazon-research/scripts && python3 price_checker.py >> /root/workspace/Projects/Amazon-Research/cron.log 2>&1") | crontab - ``` ### Technical Analysis The setup script modifies the invoking account's crontab and registers `price_checker.py` for automatic daily execution. This scheduled operation survives the current Skill invocation and therefore constitutes system persistence. Daily scheduling is related to the documented price-monitoring workflow and is disclosed in `SKILL.md`. However, the implementation lacks several controls: - It does not request explicit confirmation immediately before modifying the crontab. - It is not idempotent. Every execution appends another identical entry. - It uses hardcoded `/home/openclaw` and `/root` paths. - It runs with all permissions of the account whose crontab is modified. - It executes code directly from a mutable Skill directory. - It does not validate ownership or permissions of the scheduled script and its parent directories. - It provides no narrowly scoped uninstallation mechanism. The hardcoded `/root` log path does not itself grant root privileges. If the setup script is run as root, however, it installs the task in root's crontab and the Python script will subsequently execute with root privileges. ### Attack Path 1. A user runs `scripts/setup_cron.sh`. 2. The script installs a persistent daily task in that user's crontab. 3. The Skill directory or `scripts/price_checker.py` is subsequently modified or replaced by an actor who has write access to that location. 4. At 09:00, cron executes the modified Python script with the privileges of the crontab owner. 5. If setup was performed as root, the replaceme ...[truncated 877 chars]- Remediation
View remediation
> \"$HOME/.local/state/amazon-research/cron.log\" 2>&1 $MARKER" if ! crontab -l 2>/dev/null | grep -Fq "$MARKER"; then { crontab -l 2>/dev/null || true printf '%s\n' "$JOB" } | crontab - fi ``` ]]>