ClawHub
Back to skill

Security audit

Cron定时任务管理器

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its cron-management purpose, but it can automatically edit persistent OpenClaw configuration and run state-changing cron commands without enough guardrails.

Review before installing. This skill should only be used if you are comfortable with an agent managing OpenClaw scheduled jobs. Require confirmation before any enable, disable, run, delete, or model-change action, and do not allow the automatic sed repair unless a backup is made and the JSON is validated afterward.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:12
Finding

Unsafe In-Place Modification of Global OpenClaw Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-14
Vulnerability Type: Unsafe configuration modification
Risk Level: Medium

Vulnerable Code

sh
sed -i '/"toolCall": true/d' ~/.openclaw/openclaw.json

Technical Analysis

The skill instructs the agent to execute a line-oriented deletion against the user's global OpenClaw JSON configuration whenever openclaw cron list reports a specific error. The operation is performed without explicit user approval, a backup, JSON-aware parsing, or post-modification validation.

sed does not understand JSON structure. It deletes every line containing the matching text, rather than changing a specific, verified property. This can remove unrelated properties, delete multiple settings, or produce malformed JSON when the property shares a line with other content.

Attack Path

  1. The openclaw cron list command returns an error containing Unrecognized key: "toolCall".
  2. The agent follows the skill instructions and runs the in-place sed command.
  3. Every matching line in ~/.openclaw/openclaw.json is removed without checking its JSON context.
  4. Relevant or unrelated configuration data may be deleted.
  5. OpenClaw subsequently loads altered or invalid configuration, potentially disrupting other tasks and sessions.

An attacker who can influence the configuration content or cause the expected error may increase the impact by arranging for security-relevant settings to appear on a matching line.

Impact Assessment

The command executes with the agent process's filesystem privileges and modifies the current user's persistent OpenClaw configuration. It does not directly grant elevated operating-system privileges, but it can cause persistent configuration corruption, disable associated behavior, or disrupt all OpenClaw operations that use the affected configuration file.

Remediation
View remediation

Remediation Suggestions

  • Require explicit user confirmation before modifying global configuration.
  • Create a timestamped backup of ~/.openclaw/openclaw.json.
  • Use a JSON-aware utility or API to remove only the intended property.
  • Verify the property's exact path and current value before making changes.
  • Write the updated configuration to a temporary file, validate it as JSON, and replace the original atomically.
  • Re-run a non-destructive OpenClaw validation command after replacement.
  • If validation fails, automatically restore the backup.
  • Prefer documenting a supported OpenClaw migration or repair command instead of directly editing internal configuration.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:25
Finding

Shell Command Injection Risk Through Unvalidated Cron Identifiers and Model Names

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-42
Vulnerability Type: Command injection
Risk Level: High

Vulnerable Code

sh
openclaw cron edit <id> --model <model>
openclaw cron edit <id> --enable
openclaw cron edit <id> --disable
openclaw cron run <id>
openclaw cron rm <id>

Technical Analysis

The skill directs the agent to interpolate cron identifiers and model names into commands executed through exec, but it does not require validation, escaping, or argument-safe process invocation.

If exec invokes a shell and either value contains shell metacharacters, command substitutions, redirections, or separators, the shell may interpret the value as command syntax rather than as a single OpenClaw argument. User confirmation before a model change does not prevent injection when the resulting command is still assembled unsafely.

Model names may be provided directly by a user, while identifiers may be copied from user input or potentially untrusted command output. The documented provider/model format is descriptive and is not enforced as an allowlist.

Attack Path

  1. An attacker supplies a crafted cron identifier or model value containing shell syntax.
  2. The agent substitutes the value into one of the documented command templates.
  3. The agent passes the assembled command string to a shell-backed exec operation.
  4. The shell parses the attacker's metacharacters or command substitution.
  5. The injected command executes with the same operating-system privileges and environment as the agent.

Exploitation requires the implementation of exec to use shell parsing and requires an attacker-controlled value to be inserted without escaping. For example, a malicious model value containing a command separator could cause an additional command to run after openclaw cron edit.

Impact Assessment

Successful exploitation can execute a ...[truncated 400 chars]

Remediation
View remediation

Remediation Suggestions

  • Invoke the OpenClaw executable through an argument-array API without a shell.
  • Validate cron identifiers against the exact identifier format produced by OpenClaw.
  • Enforce a strict model-name pattern, such as an allowlisted provider and model registry, rather than accepting arbitrary text.
  • Reject whitespace, control characters, shell metacharacters, command substitutions, and leading option markers in all values.
  • Use -- before positional identifiers where the OpenClaw CLI supports it.
  • Resolve identifiers from a fresh openclaw cron list --json result instead of accepting free-form identifiers.
  • Display the validated argument list to the user before destructive operations.
  • Preserve explicit confirmation for deletion and model changes, but do not treat confirmation as a substitute for input validation.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to run sed -i against ~/.openclaw/openclaw.json, which modifies a user configuration file in place without any explicit warning, backup, or confirmation. Direct file mutation as an automatic recovery step is dangerous because it can corrupt configuration, remove legitimate settings, or silently alter security-relevant behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

All user-facing natural-language content in the skill is written in Chinese, and the file does not indicate that language selection is optional or that the skill is intentionally region-specific. This can violate language or locale policy when users have not opted into Chinese output.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger list includes broad generic terms such as 'cron' and '切换模型', which can match normal user conversation and cause the skill to activate unexpectedly. Because this skill performs administrative actions over scheduled jobs, over-broad invocation increases the chance of unintended command execution in a sensitive operational context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The enable/disable commands immediately change scheduled task behavior, but the instructions do not require confirmation, display the target task details, or warn about operational consequences. In a cron-management skill, this can interrupt production workflows or re-enable jobs that trigger unintended downstream actions.

Content

No source excerpt is available for this finding.