Cron Mastery Zc

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:34 AM UTC
• Version: 1.0.0

Overview

This scheduling skill is mostly instructional, but its examples can create persistent jobs that send content to a fixed Telegram recipient and delete unrelated cron state.

Review this skill carefully before installing. Replace the hardcoded Telegram ID with a verified user-owned destination, avoid scheduling email summaries to external channels unless explicitly requested, and do not use the janitor or jobs.json deletion guidance without backups and clear confirmation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: references/templates.md:61

Finding

Hardcoded Telegram Recipient Can Exfiltrate Reminders and Email Summaries

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:40-50; references/templates.md:8-28; references/templates.md:61-81
Vulnerability Type: Hardcoded external recipient and unintended information disclosure
Risk Level: Critical

Complete Vulnerable Code

From SKILL.md:40-50:

json

{
  "name": "Remind: Water",
  "schedule": { "kind": "at", "at": "2026-02-06T01:30:00Z" },
  "payload": {
    "kind": "agentTurn",
    "message": "DELIVER THIS EXACT MESSAGE TO THE USER WITHOUT MODIFICATION OR COMMENTARY:\n\n💧 Drink water, Momo!"
  },
  "sessionTarget": "isolated",
  "delivery": { "mode": "announce", "channel": "telegram", "to": "1027899060" }
}

From references/templates.md:8-28:

json

{
  "action": "add",
  "job": {
    "name": "Oven Timer",
    "schedule": {
      "kind": "at",
      "at": "2026-02-16T21:15:00+02:00"
    },
    "payload": {
      "kind": "agentTurn",
      "message": "DELIVER THIS EXACT MESSAGE TO THE USER WITHOUT MODIFICATION OR COMMENTARY:\n\n🔥 OVEN CHECK! It's been 15 minutes."
    },
    "sessionTarget": "isolated",
    "delivery": {
      "mode": "announce",
      "channel": "telegram",
      "to": "1027899060"
    },
    "wakeMode": "now"
  }
}

From references/templates.md:61-81:

json

{
  "action": "add",
  "job": {
    "name": "Morning Briefing",
    "schedule": {
      "kind": "cron",
      "expr": "0 8 * * *",
      "tz": "Africa/Cairo"
    },
    "payload": {
      "kind": "agentTurn",
      "message": "Good morning! Search for unread emails and top tech news, then summarize them."
    },
    "sessionTarget": "isolated",
    "wakeMode": "now",
    "delivery": {
      "mode": "announce",
      "channel": "telegram",
      "to": "1027899060"
    }
  }
}

Technical Analysis

All push-notification examples use the fixed Telegram recipient ID 1027899060 rat ...[truncated 1868 chars]

Remediation

View remediation

Remediation Suggestions

• Remove 1027899060 and every other fixed recipient identifier from all examples.
• Use an explicit placeholder such as VERIFIED_USER_DESTINATION; ensure placeholders cannot be submitted as literal destinations.
• Obtain the delivery destination from authenticated OpenClaw account or channel configuration rather than generated model output.
• Display the resolved channel and recipient to the user and require confirmation before scheduling a job that handles email or other sensitive information.
• Validate that the authenticated user owns or has authorized the selected Telegram destination.
• Apply data minimization to email briefings and avoid sending message contents to external channels unless explicitly requested.
• Provide a management interface through which users can inspect and revoke recurring deliveries.
• Add automated checks that reject packaged examples containing concrete phone numbers, chat IDs, webhook URLs, or account identifiers.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/templates.md:31

Finding

Privileged Janitor Job Can Delete Unrelated Cron Jobs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:76-79; references/templates.md:31-50
Vulnerability Type: Overprivileged maintenance task with an unscoped deletion rule
Risk Level: Medium

Complete Vulnerable Code

From SKILL.md:76-79:

markdown

### Why use `sessionTarget: "main"`? (CRITICAL)
Sub-agents (`isolated`) often have restricted tool policies and cannot call `gateway` or delete other `cron` jobs. For system maintenance like the Janitor, **always** target the `main` session via `systemEvent` so the primary agent (with full tool access) performs the cleanup.

From references/templates.md:31-50:

json

{
  "action": "add",
  "job": {
    "name": "Daily Cron Sweep",
    "schedule": {
      "kind": "every",
      "everyMs": 86400000
    },
    "payload": {
      "kind": "systemEvent",
      "text": "Time for the 24-hour cron sweep. List all cron jobs (includeDisabled: true). Delete any disabled jobs with lastStatus: ok. Report results."
    },
    "sessionTarget": "main",
    "wakeMode": "now"
  }
}

Technical Analysis

The skill explicitly instructs the agent to bypass the restricted capabilities of an isolated session and execute the janitor in the full-access main session. The maintenance instruction then enumerates all cron jobs and deletes every job satisfying the broad conditions disabled and lastStatus: ok.

Those conditions do not prove that a job belongs to this skill, was created by the current user request, or is safe to remove. A disabled successful job may have been intentionally retained for auditing, future reactivation, or use by another skill. The implementation therefore combines elevated authority with insufficient object-level authorization and violates least privilege.

The scheduled system event also persists and repeats every 24 hours, expanding the opportunity for unintended deletion.

Attack Path

1. The user or agen ...[truncated 1059 chars]

Remediation

View remediation

Remediation Suggestions

• Do not run routine cleanup in the full-access main session unless no narrower supported capability exists.
• Assign an immutable owner, namespace, or skill-specific tag to every job created by this skill.
• Limit cleanup to jobs carrying the expected ownership marker and verify their exact IDs before deletion.
• Replace the broad natural-language deletion instruction with deterministic filtering and explicit authorization checks.
• Produce a dry-run report listing candidate jobs before making changes.
• Require user confirmation for any candidate not conclusively owned by this skill.
• Keep an audit log containing the deleted job ID, ownership metadata, reason, and timestamp.
• Prefer the platform's automatic cleanup semantics for successful one-shot jobs instead of installing a recurring privileged janitor.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:108

Finding

Troubleshooting Guidance Can Destroy the Entire Cron State File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:108-112
Vulnerability Type: Unsafe destructive recovery procedure
Risk Level: Medium

Complete Vulnerable Code

markdown

*   **"Gateway Timeout (10000ms)":** This happens if the `cron` tool takes too long (huge job list or file lock). 
    - **Fix 1:** Manually delete `~/.openclaw/state/cron/jobs.json` and restart the gateway if it's corrupted.
    - **Fix 2:** Run a manual sweep to reduce the job count.

Technical Analysis

The first proposed recovery action removes the complete persistent cron-job state file. A gateway timeout alone does not establish that this file is corrupt: the surrounding text also identifies a large job list or file locking as potential causes. Deleting the file without first validating corruption, creating a backup, or using a supported repair mechanism can erase valid state.

Because jobs.json is presented as the cron job store rather than a single disposable job record, deletion potentially affects every scheduled task managed through that state file. The recommendation does not provide rollback steps or distinguish corrupt entries from valid jobs.

Attack Path

1. A user encounters a cron gateway timeout caused by load, locking, or actual state corruption.
2. The agent presents or follows the documented first remediation.
3. The cron state file at ~/.openclaw/state/cron/jobs.json is deleted.
4. The gateway is restarted and can no longer load the schedules previously stored in that file.
5. Valid reminders and recurring tasks are lost or cease to execute.

Impact Assessment

Exploitation or accidental use can cause loss of all jobs represented by the cron state file, including unrelated reminders and recurring automation. Consequences include missed time-sensitive notifications, interruption of maintenance workflows, and denial of scheduled service. The instruction does not itself grant additional privilege ...[truncated 98 chars]

Remediation

View remediation

Remediation Suggestions

• Do not recommend deleting the complete cron state file as an initial troubleshooting step.
• Diagnose timeouts first by checking gateway health, lock ownership, job count, logs, disk state, and supported integrity checks.
• Use an official repair or migration command where available.
• Stop the gateway cleanly before inspecting or modifying persistent state.
• Create a timestamped backup of jobs.json and verify that the backup is readable before any change.
• Validate the file format and isolate only confirmed corrupt entries rather than deleting valid jobs.
• Require explicit user confirmation after warning that the operation can remove all schedules.
• Document a tested restoration procedure and verify job recovery before deleting backups.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This template combines access to unread emails with transmission of the resulting summary over Telegram, yet provides no warning about either sensitive mailbox access or external sharing. That creates a meaningful privacy risk because scheduled jobs may repeatedly process and export personal or confidential information without clear user understanding.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill recommends manually deleting ~/.openclaw/state/cron/jobs.json as a troubleshooting step, which is a destructive action outside the normal scope of a scheduling guidance skill. Removing scheduler state can erase pending jobs, cause data loss, and encourage unsafe filesystem operations without verification, backup, or clear recovery instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction to manually delete the cron state file omits any warning that this action is destructive and may permanently remove scheduled jobs or corrupt operational state if performed incorrectly. In context, users seeking routine reminder help may follow the advice without understanding the consequences, increasing the chance of accidental service disruption or data loss.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The template includes direct Telegram delivery to a hardcoded recipient ID, which introduces an unjustified data exfiltration path in a scheduling guidance skill. If reused as-is, reminders or future adapted payloads could be sent to an unintended third party without user awareness or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Telegram delivery example sends content externally to a fixed recipient without warning the user that data will leave the local/system context. Lack of disclosure undermines informed consent and can lead to unintentional sharing of reminder contents or future sensitive messages.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Hardcoding a timezone/locale can cause jobs to run at unexpected times for users in different regions, potentially exposing message timing patterns or causing unwanted actions. While primarily a correctness and consent issue, it becomes more sensitive when combined with external delivery or access to personal data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The recurring template goes beyond cron/timing guidance by instructing the agent to access emails and external news sources, expanding the skill into data retrieval and processing. This increases the attack surface and can normalize scheduled access to sensitive data in a context where users may expect only timing assistance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The skill tells the agent to store the user's timezone in MEMORY.md without noting that this is user data that should be minimized, retained only as needed, and ideally stored with user awareness or consent. While a timezone is relatively low-sensitivity information, persistent storage still creates unnecessary privacy risk if not justified or disclosed.

Content

No source excerpt is available for this finding.