T06 · System Persistence
Error
- Location
SKILL.md:210- Finding
Persistent Autonomous Agent Execution Through a Scheduled Cron Job
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 210–223
Vulnerability Type:T06: System Persistence
Risk Level: HighVulnerable Code
markdown Once you have a recovery script, schedule it as a cron job that runs **only when the service is likely to fail** (e.g., every 30 minutes for browser, every hour for gateway). Use an isolated agent session to execute the script and announce failures. **Example cron job for browser recovery:** ```bash openclaw cron add \ --name "Browser‑Recovery‑Automation" \ --schedule 'every 30 minutes' \ --session isolated \ --payload '{"kind":"agentTurn","message":"Run browser recovery automation script","model":"default","thinking":"low"}' \ --delivery '{"mode":"announce","channel":"telegram"}'Agent response inside isolated session: The agent reads the script (or inline logic) and executes it via
exec. If the script exits with 0, the agent announces success; if non‑zero, the cron delivery forwards the failure message.text ### Technical Analysis The skill directs the user or agent to register a recurring scheduled task that survives the initiating skill run. Every 30 minutes, the task creates an isolated autonomous agent session and instructs it to read and execute recovery logic through `exec`. This is a system-persistence mechanism because execution continues across sessions until the cron entry is explicitly removed. Moreover, the generic agent message does not bind execution to an immutable, integrity-checked script. If the referenced workspace script or inline instructions are subsequently modified, the scheduled agent may repeatedly execute the changed logic. ### Attack Path 1. The skill is loaded and its documented recovery setup is followed. 2. The supplied `openclaw cron add` command registers a persistent job. 3. The scheduler launches a new isolated agent session every 30 minutes. 4. The session interprets the generi ...[truncated 1001 chars]- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed user authorization before creating any recurring scheduled task.
- Use one-shot, manually invoked recovery as the default behavior.
- Replace the generic autonomous-agent payload with a narrowly scoped invocation of a fixed script at an allowlisted absolute path.
- Verify the script using a cryptographic hash or signature before each execution.
- Restrict the scheduled account to the minimum filesystem, process, service, and network permissions required for recovery.
- Apply execution timeouts, concurrency limits, retry limits, and command allowlists.
- Protect recovery scripts and their parent directories from modification by less-trusted users or processes.
- Disable external notification delivery by default and require separate authorization before enabling it.
- Document commands for inspecting, disabling, and permanently deleting the scheduled job.
- Record creation and execution of the job in an auditable local log without including credentials or sensitive operational data.