T06 · System Persistence
- Location
SKILL.md:460- Finding
Persistent Hourly Cron Task with Contradictory Opt-In State
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 460–469; corroborating status declaration at line 557
Vulnerability Type: Persistent scheduled execution
Risk Level: MediumRelevant Skill Instructions
The relevant source segment defines the following behavior:
text Scheduled task configuration — manual enablement required Disabled by default. Enable only after the user explicitly requests automatic checks. Trigger time: Every hour at minute zero (`0 * * * *`) State file: `~/.openclaw/workspace/.kb_organizer/status.json` Log file: `~/.openclaw/workspace/.kb_organizer/organizer.log` Automatically pause during manual organization Record every automatic change in the log Disable command: The user says “disable automatic checks”A later status table contradicts the default-disabled statement:
text Cron | Add scheduled task | Completed — automatic check every hourTechnical Analysis
The Skill specifies an hourly cron task that can survive the initiating Skill run and continue operating in later sessions. Cross-session scheduled execution is a persistence mechanism and therefore falls under
T06: System Persistence.Scheduled monitoring may be a legitimate optional feature for maintaining organized knowledge bases. However, it is not required for the Skill's primary one-time organization function and therefore exceeds the minimum privileges necessary unless the user separately and explicitly opts in.
The main security concern is the contradiction between the configuration sections, which say that scheduling is disabled by default and requires explicit consent, and line 557, which states that the cron task has already been added and is checking hourly. An agent could interpret the latter declaration as authorization to install, retain, or assume the existence of the scheduled task without obtaining fresh consent.
The scheduled workflow can repeatedly access Feishu kno ...[truncated 2842 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the contradictory completion claim. Delete or correct line 557 so it does not state that an hourly cron task has already been added.
- Require immediate, explicit opt-in. Ask for confirmation directly before creating a scheduled task. General approval to organize a knowledge base must not authorize persistence.
- Separate one-time and scheduled modes. Keep scheduled monitoring in a distinct setup procedure or separate Skill that is not loaded during ordinary one-time organization.
- Display the exact cron configuration. Before installation, show the schedule, executable command, accessed Feishu spaces, state files, log files, expiration time, and uninstall command.
- Use bounded persistence. Assign an expiration date or maximum execution count and automatically remove the cron entry when the organization task is complete.
- Scope recurring access narrowly. Restrict scheduled checks to knowledge-base spaces explicitly selected by the user rather than scanning every accessible space.
- Require per-batch authorization. Never treat approval from a previous session or batch as authorization for later document movements.
- Provide a concrete uninstall operation. Identify the exact cron entry and supply a deterministic command or procedure to remove it and verify removal.
- Minimize persistent metadata. Avoid storing document titles when node identifiers are sufficient. Protect all state and log files with mode
0600. - Implement retention controls. Delete state, logs, document identifiers, and lock files after completion or after a short user-approved retention period.
- Audit scheduled executions. Record whether each run only inspected metadata or performed a mutation, and make this history readily visible to the user.
- Preserve least-privilege content access. Continue limiting
feishu_fetch_doccalls to ambiguous documents and do not transmit fe ...[truncated 37 chars]