BigTimer · 定时任务管家（定时消息推送·消息推送·任务管家·定时推送·定时报告·飞书推送）| Scheduled Tasks & Message Push Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:20 AM UTC
• Version: 1.0.1

Overview

BigTimer is a disclosed scheduler and message-push tool, but it gives users persistent arbitrary command execution through cron with weak validation and cleanup controls.

Review before installing. Only use this skill for trusted tasks, avoid scheduling free-form shell commands from untrusted input, prefer stdout or trusted OpenClaw messaging over arbitrary webhooks, and verify/remove any crontab entries manually after deleting tasks.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: scripts/bigtimer.py:220

Finding

Persistent Arbitrary Shell Command Execution Through Crontab

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/bigtimer.py:148

Finding

Crontab and Shell Injection Through Unvalidated Task Fields

Content

View full analysis

> {LOG_FILE} 2>&1") return f"{task['schedule']} {cmd}" ``` ```python skill_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__))) line = gen_crontab_line(t, skill_dir) cur = subprocess.run(["crontab", "-l"], capture_output=True, text=True).stdout lines = [l for l in cur.splitlines() if f"bigtimer.py run {args.name}" not in l] lines.append(line) p = subprocess.run(["crontab", "-"], input="\n".join(lines) + "\n", text=True, capture_output=True) ``` ### Technical Analysis The task name and schedule are inserted directly into crontab text without validation. The generated command also embeds `skill_dir` and `LOG_FILE` without shell quoting. A task name containing spaces, shell metacharacters, command substitutions, or redirection syntax can alter the command that cron executes. A schedule containing newline characters can terminate the intended entry and inject additional crontab entries. Paths containing spaces or shell metacharacters can similarly change command interpretation. The use of the list-based `subprocess.run(["crontab", "-"], ...)` call does not prevent this issue because the unsafe data is interpreted later by the cron parser and shell. ### Attack Path 1. An attacker creates a task with a malicious name or schedule. 2. The crafted field includes a newline, shell metacharacter, command substitution, or other cron-relevant syntax. 3. The user invokes `install` in DSH mode. 4. `gen_crontab_line` concatenates the untrusted field into raw crontab text. 5. The generated text is passed to `crontab -`. 6. Cron ...[truncated 572 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/bigtimer.py:126

Finding

Unrestricted Webhook Destination Enables Output Exfiltration and Internal Requests

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/bigtimer.py:73

Finding

Webhook Credentials Stored and Disclosed in Plaintext

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (17)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: bigtimer
description: "🕐 BigTimer · 定时任务管家 — 定时任务·定时消息推送·任务管家·定时推送·定时提醒·定时报告统一管理（cron 调度 + 消息推送，飞书/多端）。OpenClaw 环境自动走 openclaw cron + message send，DSH 环境自动走 crontab + 飞书 webhook。支持定时任务增删改查、立即执行、调度条目生成，biga/eyes/bigfocus/listform 等技能的定时消息推送可统一接入。触发词：定时任务、定时消息推送、消息推送、任务管家、定时推送、定时提醒、定时报告、定时扫描。| Scheduled tasks & message push manager — cron jobs, scheduled message push, task manager, auto push to Feishu/multi-channel, dual-env (OpenClaw/DSH)."
triggers:
  - 定时任务
  - 定时推送
  - bigtimer
  - BigTimer
  - 定时器
  - 定时提醒
  - 定时报告
  - 定时汇报

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/bigtimer.py (reported line 208)May include surrounding context.

python

s": t.get("last_status"),
        })
    return {"ok": True, "tasks": out}

def cmd_remove(args):
    tasks = load_tasks()
    if args.name not in tasks:
        return {"ok": False, "error": f"任务不存在: {args.name}"}
    del tasks[args.name]
    save_tasks(tasks)
    log(f"remove 任务 {args.name}")
    return {"ok": True, "removed": args.name, "tip": "需手动移除系统调度条目（crontab -e / openclaw cron remove）"}

def cmd_status(args):
    tasks = load_tasks()
    if args.name not in tasks:
        return {"ok": False, "error": f"任务不存在: {args.name}"}
    t = tasks[args.name]
    t["env"] = detect_env()
    return {"ok": True, "task": t}

def cmd_run(args):
    tasks = load_tasks()
    if args.name not in tasks:
        return {"ok": False, "error": f"任务不存在: {args.name}"}
    t = tasks[args.name]
    log(f"run 任务 {args.name}: {t['action']}")
    # 执行 action（shell 命令）
    p = subprocess.Popen(["bash", "-c", t["action"]],

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill presents itself as a scheduler/message-push manager, but in practice it stores and executes arbitrary shell commands. That gap materially increases risk because users may reasonably expect task orchestration, not a persistent arbitrary-command runner capable of executing harmful payloads on schedule.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill explicitly documents capabilities to execute shell commands, inspect environment-dependent behavior, and write persistent scheduler state, yet it declares no tool scope or permission boundaries. In an agent ecosystem, that omission can cause the skill to be invoked with broader-than-expected authority, increasing the chance of arbitrary command execution or persistence via cron/crontab without clear user consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger set contains broad everyday phrases like '消息推送', '定时提醒', and '定时任务', which can match ordinary user requests and activate a powerful skill that creates scheduled jobs or pushes messages. Because this skill can install cron entries and run arbitrary actions, overbroad invocation materially raises the risk of unintended persistence or execution from benign conversational prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation says DSH mode 'automatically writes crontab' but does not present this as a prominent security warning despite the persistence and system-modification implications. Users or orchestrators may treat installation as routine output generation, when it actually creates durable scheduled execution that may continue outside the agent session.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The module docstring, usage text, and user-facing help strings are presented in Chinese, effectively imposing a specific language on users without opt-in or justification. Per the stated policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/bigtimer.py (reported line 103)May include surrounding context.

python

segs = [p.strip() for p in re.split(r"\n{2,}", content) if p.strip()]
    results = []
    for i, seg in enumerate(segs):
        p = subprocess.Popen(
            ["openclaw", "message", "send", "--channel", channel, "--target", target,
             "--message", seg, "--json"],
            stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Task output can be sent to an arbitrary webhook without strong user-facing disclosure that command results may leave the host. Because task output may contain secrets, logs, or system data produced by the arbitrary shell action, silent network egress materially increases confidentiality risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/bigtimer.py (reported line 123)May include surrounding context.

python

if not webhook_url:
        return {"ok": False, "error": "缺少 webhook URL"}
    payload = {"msg_type": "text", "content": {"text": content[:4000]}}
    p = subprocess.Popen(
        ["curl", "-s", "-X", "POST", "-H", "Content-Type: application/json",
         "-d", json.dumps(payload, ensure_ascii=False), webhook_url],
        stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/bigtimer.py (reported line 208)May include surrounding context.

python

del tasks[args.name]
    save_tasks(tasks)
    log(f"remove 任务 {args.name}")
    return {"ok": True, "removed": args.name, "tip": "需手动移除系统调度条目（crontab -e / openclaw cron remove）"}

def cmd_status(args):
    tasks = load_tasks()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Scheduled shell command execution occurs without a clear execution-time warning or confirmation, so once a task is created it can run arbitrary commands later with little visibility. In a scheduling skill, that significantly raises the chance of hidden destructive actions or delayed payload execution, especially if tasks are added by another agent or workflow.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

The task action is executed with bash -c using stored task data, which enables arbitrary shell command execution. Because this skill is a scheduler that persists and later re-runs commands, a malicious or unsafe task can execute destructive commands, steal secrets, or establish persistence without further confirmation at run time.

Content

Scanner excerpt · scripts/bigtimer.py (reported line 225)May include surrounding context.

python

t = tasks[args.name]
    log(f"run 任务 {args.name}: {t['action']}")
    # 执行 action（shell 命令）
    p = subprocess.Popen(["bash", "-c", t["action"]],
                         stdout=subprocess.PIPE, stderr=subprocess.PIPE,
                         cwd=os.path.dirname(os.path.abspath(__file__)))
    out, err = p.communicate(timeout=300)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The install flow modifies the system crontab, which is a stronger side effect than simple task management and creates persistence on the host. In context, this is risky because users may not anticipate that using the skill can alter long-lived system scheduler state.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/bigtimer.py (reported line 274)May include surrounding context.

python

# DSH 环境：写入 crontab
    skill_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
    line = gen_crontab_line(t, skill_dir)
    cur = subprocess.run(["crontab", "-l"], capture_output=True, text=True).stdout
    lines = [l for l in cur.splitlines() if f"bigtimer.py run {args.name}" not in l]
    lines.append(line)
    p = subprocess.run(["crontab", "-"], input="\n".join(lines) + "\n", text=True, capture_output=True)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

This code writes entries into the user's system crontab based on task data, creating durable host-level persistence. Combined with arbitrary task actions, it allows scheduled execution of attacker-controlled commands beyond the immediate session and can survive user context changes until manually removed.

Content

Scanner excerpt · scripts/bigtimer.py (reported line 277)May include surrounding context.

python

cur = subprocess.run(["crontab", "-l"], capture_output=True, text=True).stdout
    lines = [l for l in cur.splitlines() if f"bigtimer.py run {args.name}" not in l]
    lines.append(line)
    p = subprocess.run(["crontab", "-"], input="\n".join(lines) + "\n", text=True, capture_output=True)
    if p.returncode == 0:
        log(f"install 任务 {args.name} → crontab: {line}")
        return {"ok": True, "env": "dsh", "crontab": line}

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

When channel/target are missing, the code loads biga-send-config.json from shared memory to obtain delivery settings. For a timer/push manager, silently consuming another skill's configuration is not an obvious requirement and expands behavior beyond the manifest's stated scope.

Content

No source excerpt is available for this finding.