T06 · System Persistence
Error
- Location
- SKILL.md:24
- Finding
- Persistent Unattended Update Task<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:24-33` **Vulnerability Type**: Persistent scheduled execution **Risk Level**: High ### Vulnerable Code ```bash clawdbot cron add \ --name "Daily Auto-Update" \ --cron "0 4 * * *" \ --tz "America/Los_Angeles" \ --session isolated \ --wake now \ --deliver \ --message "Run daily auto-updates: check for Clawdbot updates and update all skills. Report what was updated." ``` ### Technical Analysis The Skill instructs the Agent to create a recurring cron task that survives the initial Skill session. The task wakes an isolated Agent session every day and directs it to update Clawdbot and all installed Skills. Although this persistence is disclosed as the Skill's intended functionality, the scheduled task creates a durable execution mechanism that operates without renewed user authorization. Its update targets are mutable, so the effective behavior of future scheduled runs can change after the Skill itself has been reviewed. ### Attack Path 1. A user asks the Agent to configure automatic updates. 2. The Agent installs the named daily cron task. 3. The task persists after the setup session and wakes an isolated Agent session every day. 4. A future update source, Clawdbot release, or installed Skill is compromised. 5. The scheduled session installs the compromised update without obtaining fresh approval. 6. The compromised component executes with the permissions of the Gateway or Agent user during subsequent operations. ### Impact Assessment An attacker controlling an accepted update could obtain code execution under the account running Clawdbot. The accessible scope may include writable Skill directories, Clawdbot configuration and state, local files available to that account, and any tools or credentials exposed to the affected Agent runtime. The cron task itself does not demonstrate privilege escalation or credential theft. The principal risk is persistent, unattended execution combin ...[truncated 37 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Default to a scheduled dry run such as `clawdhub update --all --dry-run` rather than automatic installation. 2. Present the proposed versions, package origins, integrity information, and release changes to the user. 3. Require explicit approval before applying each update batch. 4. Pin the allowed update commands and prevent the scheduled message from becoming an unrestricted instruction channel. 5. Provide clear commands to inspect, pause, and remove the scheduled task. 6. Run update checks in a restricted sandbox with no unnecessary credentials or filesystem access. 7. Record the cron task identifier, creation time, initiator, and each execution result in an auditable log. ]]>