T06 · System Persistence
Error
- Location
- SKILL.md:304
- Finding
- Persistent Autonomous Social-Media Actions Through Scheduled Agent Tasks<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:304-352` **Vulnerability Type**: Persistent scheduled tasks performing credentialed external actions **Risk Level**: High ### Vulnerable Code ```bash # Mention check — every 2 hours during business hours openclaw cron add \ --schedule "0 8-20/2 * * *" \ --tz "America/New_York" \ --payload '{"kind":"agentTurn","message":"Check X mentions with xpost mentions --count 20. Reply to any new mentions following engagement rules. Skip blocklisted accounts."}' \ --name "mention-check" ``` ```bash # Active posting window: 9 AM - 6 PM weekdays openclaw cron add \ --schedule "0 9,12,15,18 * * 1-5" \ --tz "America/New_York" \ --payload '{"kind":"agentTurn","message":"Post a tweet appropriate for this time slot. Morning=insight, Midday=engagement, Afternoon=tactical, Evening=personality. Check the content cadence framework."}' \ --name "scheduled-posts" ``` ### Technical Analysis The Skill instructs users to install recurring OpenClaw cron tasks that initiate future Agent turns and perform credentialed X/Twitter operations. The `mention-check` task may autonomously read untrusted public mentions and publish replies, while `scheduled-posts` directs the Agent to generate and publish new content multiple times each weekday. These tasks persist beyond the Skill invocation and the session in which they were created. They therefore establish an ongoing execution mechanism with access to the X account credentials configured at `~/.config/x-api/keys.env`. The persistence exceeds the minimum privileges necessary to provide individual post, search, like, or reply operations. The declared API functionality can be delivered through explicit, user-initiated commands without registering recurring background tasks. Risk is further increased by the approval policy at `SKILL.md:173-181`, which permits replies, likes, retweets, scheduled posts, quote tweets, and standard engagement replies without human appro ...[truncated 2209 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove cron registration from the default setup and quick-start workflow. Keep ordinary X operations explicitly user-initiated. 2. Require clear, separate, informed opt-in before creating any recurring task. Display its schedule, payload, affected account, permitted actions, and expiration time. 3. Require human approval immediately before every public post, reply, quote tweet, retweet, or other state-changing action. 4. Restrict autonomous scheduled tasks to read-only operations where possible. Store proposed posts and replies as drafts rather than publishing them. 5. Assign every scheduled task a short expiration time and a maximum execution count. Avoid indefinite recurring jobs. 6. Provide exact commands to list, disable, and remove every cron job created by the Skill, and verify successful removal. 7. Use separate least-privilege API credentials for read-only monitoring and posting. Do not expose write-capable credentials to jobs that only need to read mentions. 8. Track processed mention IDs and enforce strict rate, duplicate, and per-account limits to prevent repeated or amplified interactions. 9. Treat all mention, timeline, queue, and search content as untrusted data. Keep it structurally separated from Agent instructions and reject instruction-like content before it reaches content-generation prompts. 10. Maintain an auditable log of scheduled executions, drafts, approvals, and resulting API actions. Alert the account owner whenever a state-changing action occurs. 11. Add an emergency stop mechanism that revokes posting access and disables all related scheduled tasks. 12. Correct the package documentation stating that the `xpost` script is included when the audited project contains only `SKILL.md`, or include the implementation so its credential handling and command construction can be reviewed. ]]>