T06 · System Persistence
Error
- Location
README-install-monday-cleanup.md:23- Finding
Persistent Scheduled and Boot-Time Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Openclaw Dual Cleanup
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real OpenClaw cleanup utility, but its broad file-deletion logic and optional persistent automation create a meaningful risk of unintended data loss.
Review before installing. Use dry-run first, inspect every candidate path, avoid force mode until the file list is verified, do not enable the cron or boot-time examples, and do not run it with sudo or administrator privileges. Treat it as a destructive maintenance tool, not a harmless cache cleaner.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/clean-sessions-dual.py:153- Finding
Overbroad Recursive Matcher Can Permanently Delete Unrelated Files
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
README.md:174- Finding
Documentation Encourages Unnecessary Administrator or Root Execution
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (30)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The changelog documents multiple automatic cleanup behaviors, including immediate cleanup when file count exceeds 10 and scheduled deep-clean execution, but it does not clearly warn users that these actions may delete session files or other data without an explicit confirmation step. In the context of a cleanup skill that targets accumulated files, this omission increases the risk of unintended data loss because users may enable or upgrade the skill without understanding the deletion semantics or recovery limitations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The changelog advertises 'more thorough physical file cleanup' and 'more彻底的物理文件清理' without any accompanying warning that the feature is destructive, may permanently delete user data, or requires careful scope validation. In a cleanup skill whose purpose is deleting files to work around lazy deletion behavior, omission of data-loss cautions increases the risk that operators will run it on valuable session or workspace data under a false sense of safety.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 打开Crontab编辑器 crontab -e # 添加以下行（每周一9:00执行深度清理） 0 9 * * 1 /usr/bin/pwsh -File ~/.openclaw/workspace/skills/openclaw-dual-cleanup/scripts/monday-deep-clean.ps1
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README provides direct commands to run deep-cleanup scripts, including a forced execution path, without prominently warning that cleanup may delete or alter session files and logs. In an agent skill context, this increases the chance of accidental destructive actions by users who treat the documentation as operationally safe.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README explicitly promotes force cleanup modes that delete physical session files, but it does not clearly warn that deletion is irreversible and may remove valuable user/session history. In a skill whose purpose is file cleanup, this omission increases the chance of accidental destructive use, especially because users may copy commands directly from documentation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README recommends scheduled automated force cleanup, which can repeatedly delete user session data without interactive review. In the context of a session-management cleanup skill, automation magnifies the blast radius of mistakes such as overly broad file matching, wrong hour thresholds, or cleanup of still-needed records.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md **解决**: 使用双重清理机制，确保两个步骤都执行 #### Q3: 缺少权限无法删除文件 **解决**: 以管理员身份运行脚本 (Windows) 或使用sudo (Linux/macOS) #### Q4: OpenClaw命令不可用 **解决**: 确保OpenClaw已正确安装并添加到PATH环境变量
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill describes shell/script execution, file access, and environment interaction but does not declare any explicit tool scope or permissions. That creates a least-privilege failure: an agent may invoke powerful capabilities for deletion and persistence without transparent authorization boundaries, increasing the risk of unintended or abusive destructive actions.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file says weekly/monthly automatic cleanup was canceled, then later presents a multi-layer design that still includes those automated behaviors. Contradictions around destructive file deletion can cause accidental retention bypass, unexpected execution, or reviewer misunderstanding about operational risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases are broad everyday language such as '清理会话' and similar variants, which can easily match normal user requests. In a skill that performs deletion and scheduling behavior, overbroad activation raises the chance of unintended invocation of destructive operations or follow-on script execution.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The activation conditions mix keywords, heartbeat logic, and scheduled tasks in a way that is internally inconsistent and ambiguous. Ambiguous activation is risky for a cleanup skill because it obscures what event actually authorizes file deletion, making accidental or unauthorized execution more likely.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document gives conflicting statements about automation, claiming only Monday 9:00 deep cleanup while also advertising monthly and weekly automated cleanup in the trigger section. Security-relevant behavior that is ambiguous is dangerous because users and reviewers cannot reliably predict when destructive cleanup actions will run.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
The skill documents persistent scheduled execution via crontab, enabling recurring autonomous cleanup behavior outside an immediate user action. Persistence is especially dangerous here because the skill performs destructive file deletion, so a misconfigured or maliciously modified schedule could repeatedly remove files without timely visibility.
- Content
Crontab示例（杜优化版）
bash # 编辑Crontab示例 # crontab -e # 根据杜的要求：只在每周一9:00自动进行一次深度清理 # 取消月度、周度自动清理，专注单次周一清理
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file states “完整中文文档” and the entire skill interface and examples are presented only in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless clearly justified as region-specific.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrase "清理旧会话" is generic enough to match ordinary user requests about cleaning up sessions, which can cause this skill to activate outside a clearly OpenClaw-specific context. Because the skill is described as performing automated cleanup across platforms, accidental invocation could lead to unintended deletion or maintenance actions rather than a harmless response.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The trigger phrase "清理会话缓存" overlaps with common support or housekeeping requests a user might make in normal conversation, so the skill may be selected when the user did not intend to invoke this specific maintenance workflow. In a cleanup skill that claims automatic remediation of deletion defects and file accumulation, such ambiguity increases the risk of unintended file or state changes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest sets the skill language to "zh-CN", which can constitute a locale policy issue when no user opt-in, alternative language support, or justification is provided. In this file, there is no accompanying indication that the language restriction is optional or region-specific by design.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest explicitly sets the skill language to "zh-CN", which indicates a fixed language/locale requirement. Under the stated policy, forcing a specific language without offering user choice or documenting a justified regional constraint is a natural-language policy violation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger phrase "清理会话" is generic and likely to match ordinary user requests to clean up sessions, without clearly limiting the action to OpenClaw-specific caches or requiring confirmation. In a skill that performs automated cleanup across platforms, this increases the chance of unintended invocation and accidental deletion or disruption of user data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest explicitly sets the skill language to "zh-CN", and the surrounding metadata and triggers are Chinese-only. There is no indication that users may choose another language or that this locale restriction is an intentional, documented regional requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script's natural-language interface, help text, prompts, and status messages are entirely in Chinese, including confirmation prompts and usage guidance. There is no indication that the user can select another language or that the locale restriction is intentionally limited to a Chinese-speaking environment.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The stated purpose is cleanup of OpenClaw session artifacts, but the implementation shells out to an external 'openclaw' executable to probe availability and execute cleanup commands. Spawning subprocesses is a materially broader capability than simple local file maintenance and is not explicitly declared in the manifest description.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def check_openclaw_available(self): """检查OpenClaw是否可用""" try: result = subprocess.run( ["openclaw", "--version"], capture_output=True, text=True,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def run_openclaw_command(self, cmd, show_output=True): """运行OpenClaw命令""" try: result = subprocess.run( cmd, capture_output=True, text=True,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Force mode enables irreversible deletion of files without an explicit final warning, increasing the chance of destructive operator error. In this script, file identification is broad and based on name patterns plus age, so an accidental force invocation could remove more application data than the user expects.
- Content