T06 · System Persistence
- Location
README.md:279- Finding
Recurring Scheduled Jobs Enable Persistent Unattended Agent Execution
- Content
View full analysis
Vulnerability Details
File Location:
README.md:279-313
Vulnerability Type:T06: System Persistence
Risk Level: HighVulnerable Code
bash ### Daily Progress Report (10 PM) openclaw cron add \ --name "Daily Progress Report" \ --cron "0 22 * * *" \ --tz "America/Vancouver" \ --session isolated \ --message "Generate daily progress report. Read tasks/QUEUE.md for completed tasks. Summarize: completed, in progress, blockers, tomorrow's plan." ### Morning Kickoff (7 AM) openclaw cron add \ --name "Morning Kickoff" \ --cron "0 7 * * *" \ --tz "America/Vancouver" \ --session main \ --system-event "Morning kickoff: Review task queue, pick top priorities, spawn team members for parallel work." \ --wake now ### Overnight Work Check (3 AM) openclaw cron add \ --name "Overnight Work" \ --cron "0 3 * * *" \ --tz "America/Vancouver" \ --session isolated \ --message "Overnight work session. Pull tasks from queue that don't need human input. Do research, writing, or analysis. Log progress."Technical Analysis
The documented installation process creates recurring scheduled jobs that survive the session in which the skill is configured. These jobs automatically wake an agent and direct it to perform work without contemporaneous user authorization.
The morning job is especially sensitive because it targets the main session and instructs the agent to spawn additional agents. The overnight job reads work from a mutable task queue. The scheduled payload is therefore not limited to a fixed, reviewed operation: its effective behavior can change whenever queue contents change.
Although these commands are presented as setup instructions rather than automatically executed package code, following the documented workflow establishes cross-session persistence and repeated autonomous execution.
Attack Path
- A user follows the README and installs t ...[truncated 1186 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the recurring cron setup from the default or recommended installation path.
- Require explicit, per-run user authorization before performing queue tasks.
- If scheduling is necessary, ship all jobs disabled by default and require informed opt-in.
- Restrict scheduled sessions to isolated, least-privileged environments with no unnecessary credentials, shell access, or write access.
- Use a strict allowlist of fixed, read-only scheduled operations rather than executing arbitrary queue content.
- Validate queue entries against task and tool policies before execution.
- Prohibit scheduled jobs from spawning additional agents without explicit approval.
- Apply limits for runtime, token consumption, tool calls, and the number of tasks processed per event.
- Document commands to list, disable, and remove every installed cron entry.
- Maintain an audit log and notify the user before and after every scheduled execution.