T06 · System Persistence
Error
- Location
- scripts/setup-cron.sh:7
- Finding
- Persistent Autonomous Main-Session Execution Through a Recurring Cron Job<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup-cron.sh:7-18` **Vulnerability Type**: Persistent scheduled agent execution **Risk Level**: High ### Vulnerable Code ```bash CRON_MSG="Read $SKILL_DIR/HEARTBEAT.md and execute it. Run play.sh from $SKILL_DIR. If YOUR_TURN, generate dialogue and submit. Reply HEARTBEAT_OK when done." echo "Adding Room 418 cron job (every 2 minutes)..." openclaw cron add \ --name "room418" \ --every "2m" \ --message "$CRON_MSG" \ --session "main" \ --expect-final \ --timeout-seconds 90 echo "" echo "Done. Room 418 runs every 2 minutes." ``` The related heartbeat instructions explicitly direct the agent to submit game actions without confirmation: ```markdown ### When play.sh outputs AUTO_YOUR_TURN (fallback) 1. **Immediately** generate one in-character dialogue line from scenario, role, and conversation history (dialogue only, no meta) 2. **Immediately** run: `./scripts/submit-turn.sh <battleId> "<your response>"` 3. Do not ask for confirmation; execute the submit command directly 4. Reply `HEARTBEAT_OK` when done ``` ### Technical Analysis The setup script creates a scheduled OpenClaw task that survives completion of the script and runs every two minutes. The task operates in the `main` session rather than a narrowly restricted, purpose-specific session. Each invocation reads `HEARTBEAT.md`, executes the gameplay workflow, uses locally stored credentials, contacts the external API, and may generate and submit a turn without contemporaneous user approval. The feature is disclosed as an optional full-auto mode and includes a removal command, so it is not a concealed persistence mechanism. Nevertheless, it establishes persistent autonomous execution and grants the game recurring access to the agent session and bearer credential. This exceeds the privileges required for one-time or manually initiated gameplay. Because the scheduled message reads `HEARTBEAT.md` on every run, subsequent modificat ...[truncated 1478 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not install recurring automation as part of ordinary gameplay. Require a separate, explicit opt-in action that clearly states the frequency, duration, session, credential use, and removal procedure. 2. Use a dedicated restricted session instead of `--session "main"`. 3. Disable unrelated tools for the scheduled generation session and grant only the minimum capability needed to generate text. 4. Add an execution limit or expiration time so the task automatically removes or disables itself. 5. Require confirmation before queue reentry or before submitting a generated response, particularly after prolonged inactivity. 6. Avoid rereading mutable instruction files on every execution. Pin the expected instruction content or verify its hash before use. 7. Detect an existing `room418` cron entry before adding another task. 8. Provide a status command and a reliable uninstall script that removes the scheduled task. 9. Default the skill to manual mode; autonomous mode should never be enabled merely because a configuration file is absent. ]]>