Security audit

Cron定时任务管理器

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its cron-management purpose, but it can automatically edit persistent OpenClaw configuration and run state-changing cron commands without enough guardrails.

Review before installing. This skill should only be used if you are comfortable with an agent managing OpenClaw scheduled jobs. Require confirmation before any enable, disable, run, delete, or model-change action, and do not allow the automatic sed repair unless a backup is made and the JSON is validated afterward.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:12
Finding: Unsafe In-Place Modification of Global OpenClaw Configuration## Vulnerability Details **File Location**: `SKILL.md`, lines 12-14 **Vulnerability Type**: Unsafe configuration modification **Risk Level**: Medium ### Vulnerable Code ```sh sed -i '/"toolCall": true/d' ~/.openclaw/openclaw.json ``` ### Technical Analysis The skill instructs the agent to execute a line-oriented deletion against the user's global OpenClaw JSON configuration whenever `openclaw cron list` reports a specific error. The operation is performed without explicit user approval, a backup, JSON-aware parsing, or post-modification validation. `sed` does not understand JSON structure. It deletes every line containing the matching text, rather than changing a specific, verified property. This can remove unrelated properties, delete multiple settings, or produce malformed JSON when the property shares a line with other content. ### Attack Path 1. The `openclaw cron list` command returns an error containing `Unrecognized key: "toolCall"`. 2. The agent follows the skill instructions and runs the in-place `sed` command. 3. Every matching line in `~/.openclaw/openclaw.json` is removed without checking its JSON context. 4. Relevant or unrelated configuration data may be deleted. 5. OpenClaw subsequently loads altered or invalid configuration, potentially disrupting other tasks and sessions. An attacker who can influence the configuration content or cause the expected error may increase the impact by arranging for security-relevant settings to appear on a matching line. ### Impact Assessment The command executes with the agent process's filesystem privileges and modifies the current user's persistent OpenClaw configuration. It does not directly grant elevated operating-system privileges, but it can cause persistent configuration corruption, disable associated behavior, or disrupt all OpenClaw operations that use the affected configuration file.
Remediation: ## Remediation Suggestions - Require explicit user confirmation before modifying global configuration. - Create a timestamped backup of `~/.openclaw/openclaw.json`. - Use a JSON-aware utility or API to remove only the intended property. - Verify the property's exact path and current value before making changes. - Write the updated configuration to a temporary file, validate it as JSON, and replace the original atomically. - Re-run a non-destructive OpenClaw validation command after replacement. - If validation fails, automatically restore the backup. - Prefer documenting a supported OpenClaw migration or repair command instead of directly editing internal configuration.

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:25
Finding: Shell Command Injection Risk Through Unvalidated Cron Identifiers and Model Names## Vulnerability Details **File Location**: `SKILL.md`, lines 25-42 **Vulnerability Type**: Command injection **Risk Level**: High ### Vulnerable Code ```sh openclaw cron edit <id> --model <model> openclaw cron edit <id> --enable openclaw cron edit <id> --disable openclaw cron run <id> openclaw cron rm <id> ``` ### Technical Analysis The skill directs the agent to interpolate cron identifiers and model names into commands executed through `exec`, but it does not require validation, escaping, or argument-safe process invocation. If `exec` invokes a shell and either value contains shell metacharacters, command substitutions, redirections, or separators, the shell may interpret the value as command syntax rather than as a single OpenClaw argument. User confirmation before a model change does not prevent injection when the resulting command is still assembled unsafely. Model names may be provided directly by a user, while identifiers may be copied from user input or potentially untrusted command output. The documented `provider/model` format is descriptive and is not enforced as an allowlist. ### Attack Path 1. An attacker supplies a crafted cron identifier or model value containing shell syntax. 2. The agent substitutes the value into one of the documented command templates. 3. The agent passes the assembled command string to a shell-backed `exec` operation. 4. The shell parses the attacker's metacharacters or command substitution. 5. The injected command executes with the same operating-system privileges and environment as the agent. Exploitation requires the implementation of `exec` to use shell parsing and requires an attacker-controlled value to be inserted without escaping. For example, a malicious model value containing a command separator could cause an additional command to run after `openclaw cron edit`. ### Impact Assessment Successful exploitation can execute a ...[truncated 400 chars]
Remediation: ## Remediation Suggestions - Invoke the OpenClaw executable through an argument-array API without a shell. - Validate cron identifiers against the exact identifier format produced by OpenClaw. - Enforce a strict model-name pattern, such as an allowlisted provider and model registry, rather than accepting arbitrary text. - Reject whitespace, control characters, shell metacharacters, command substitutions, and leading option markers in all values. - Use `--` before positional identifiers where the OpenClaw CLI supports it. - Resolve identifiers from a fresh `openclaw cron list --json` result instead of accepting free-form identifiers. - Display the validated argument list to the user before destructive operations. - Preserve explicit confirmation for deletion and model changes, but do not treat confirmation as a substitute for input validation.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill instructs the agent to run `sed -i` against `~/.openclaw/openclaw.json`, which modifies a user configuration file in place without any explicit warning, backup, or confirmation. Direct file mutation as an automatic recovery step is dangerous because it can corrupt configuration, remove legitimate settings, or silently alter security-relevant behavior.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: All user-facing natural-language content in the skill is written in Chinese, and the file does not indicate that language selection is optional or that the skill is intentionally region-specific. This can violate language or locale policy when users have not opted into Chinese output.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger list includes broad generic terms such as 'cron' and '切换模型', which can match normal user conversation and cause the skill to activate unexpectedly. Because this skill performs administrative actions over scheduled jobs, over-broad invocation increases the chance of unintended command execution in a sensitive operational context.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The enable/disable commands immediately change scheduled task behavior, but the instructions do not require confirmation, display the target task details, or warn about operational consequences. In a cron-management skill, this can interrupt production workflows or re-enable jobs that trigger unintended downstream actions.

Static analysis

No suspicious patterns detected.