OpenClaw Task Scheduler

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:47 AM UTC
• Version: 1.0.0

Overview

This task scheduler is not malicious, but it requests broad write, command, and cron authority while key advertised features are missing or under-scoped.

Review this skill before installing. It appears to be an incomplete scheduler rather than malware, but grant it only the minimum tools needed, avoid cron access until real scheduled execution is implemented and scoped, pin or remove unused dependencies, and do not expose any future WebSocket service beyond localhost without authentication and network controls.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Excessive Tool Permissions Violate Least-Privilege Requirements

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:4-9
Vulnerability Type: Excessive command-execution, filesystem-write, and cron permissions
Risk Level: Medium

Vulnerable Code:

yaml

tools:
  - read
  - write
  - exec
  - cron

Technical Analysis

The Skill requests write, exec, and cron capabilities even though the reviewed implementation does not require all of them for its current in-memory scheduling behavior.

In particular, recurring scheduling is only a placeholder in lib/scheduler.py:119-126:

python

def schedule_task(self, description: str, cron: str,
                 priority: TaskPriority = TaskPriority.MEDIUM,
                 handler: Optional[Callable] = None) -> str:
    """Schedule a recurring task (placeholder for cron)"""
    # For now, just create immediate task
    # Full cron support would require a separate scheduler
    task = self.create_task(description, priority, handler)
    return task.id

This method ignores the supplied cron expression and immediately creates an in-memory task. No reviewed code imports a cron library, modifies a user or system crontab, registers a service, or establishes another cross-session startup mechanism.

The CLI daemon at scripts/main.py:109-125 also starts only an in-process worker:

python

async def cmd_daemon(args):
    """Run scheduler daemon"""
    scheduler = TaskScheduler(max_concurrency=args.concurrency)

    print(f"🚀 Starting Task Scheduler")
    print(f"   Concurrency: {args.concurrency}")
    print(f"   WebSocket port: {args.ws_port}")

    await scheduler.start()

    try:
        print("\n✅ Scheduler running. Press Ctrl+C to stop.")
        while True:
            await asyncio.sleep(1)
    except KeyboardInterrupt:
        print("\n🛑 Stopping scheduler...")
        await scheduler.stop()
        print("✅ Scheduler stopped")

The --ws-port value is pr ...[truncated 1603 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove cron from the declared tools until genuine recurring scheduling is implemented and reviewed.
2. Remove exec if tasks can be limited to registered in-process Python handlers.
3. If command execution is required, use an explicit allowlist of executables and arguments rather than granting general shell access.
4. Restrict writes to a dedicated application-state directory with restrictive filesystem permissions.
5. Require explicit user approval before creating any future scheduled task or persistent service.
6. Document why each requested tool is necessary and ensure host-side authorization is scoped per operation.
7. Add tests that compare declared capabilities against capabilities exercised by the implementation.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:5

Finding

Unused and Loosely Constrained WebSocket Dependency Expands Supply-Chain Exposure

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:5-7
Vulnerability Type: Unnecessary and non-reproducibly constrained third-party dependency
Risk Level: Low

Vulnerable Code:

text

# WebSocket support
websockets>=11.0.0

Technical Analysis

The websockets package is declared with only a minimum version and no upper bound, exact pin, or integrity hash. The reviewed Python files do not import this package, and the purported WebSocket port in the CLI is only displayed rather than used to create a server.

Because the package does not support any currently implemented behavior, installing it unnecessarily expands the dependency graph and supply-chain attack surface. The open-ended constraint also allows the resolver to select future releases that were not reviewed with this Skill.

The audit did not identify evidence that websockets is malicious or that the dependency name is a typosquat. The issue is the avoidable installation of unused third-party code and the absence of reproducible dependency controls.

The commented entry at requirements.txt:10 is not an active dependency:

text

# python-crontab>=2.6.0

No code imports python-crontab or uses it to install scheduled tasks.

Attack Path

1. An operator installs the dependencies from requirements.txt.
2. The package resolver selects any available websockets release satisfying the minimum version.
3. Third-party package code enters the environment even though the Skill does not use its WebSocket functionality.
4. If a selected current or future release is compromised or incompatible, installation or later import by another component could expose the environment to that release's behavior.

This is a supply-chain hardening issue rather than evidence of an active malicious dependency.

Impact Assessment

Potential impact is limited to the permissions of the environment performing installation or run ...[truncated 379 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove websockets from requirements.txt until WebSocket functionality is actually implemented.
2. If it becomes necessary, pin a reviewed exact version rather than using an unrestricted minimum-version constraint.
3. Generate and verify cryptographic hashes through a locked dependency file.
4. Use an automated dependency scanner and a controlled update process.
5. Install dependencies in an isolated, least-privileged virtual environment.
6. Keep python-crontab absent unless system cron integration is intentionally implemented, justified, and separately authorized.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code substantially matches the general domain of task queue management and background task control with priority handling, cancellation, retries, and status/event notifications. However, two key declared capabilities are not actually present in this code chunk: WebSocket real-time updates and true scheduled/recurring task execution. The schedule_task method explicitly notes it is a placeholder and simply enqueues an immediate task. Event delivery is implemented through in-process callbacks, not WebSockets. Because these are prominent advertised features rather than minor implementation details, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill requests powerful tools including write, exec, and cron in frontmatter, but does not define any explicit tool-scope restriction such as allowed-tools or permissions. In an agent environment, this creates unnecessary authority and weakens containment, making accidental or malicious task definitions more capable of modifying files or scheduling persistent actions than users may expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation instructs users to start a WebSocket service and connect to it, but provides no warning about network exposure, authentication, or leakage of task metadata. Combined with the sample configuration binding the WebSocket host to 0.0.0.0, this could expose real-time task details to unintended local or remote clients if deployed incautiously.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file describes cancel and delete task operations, which can terminate running work or remove task records, but it does not include any warning about data loss, irreversibility, or the need to confirm intent. Under the markdown-specific missing-warning rule, user-facing documentation should disclose behaviors that may affect user data or task integrity.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a scheduler that supports immediate, scheduled, and recurring tasks. However, schedule_task is explicitly a placeholder and simply calls create_task, so cron/scheduled recurrence is not actually implemented.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstring says Schedule a recurring task, which asserts recurring behavior. The body immediately creates a normal task and returns its ID, and the inline comments admit this is only a placeholder, directly contradicting the documented behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · lib/scheduler.py (reported line 121)May include surrounding context.

python

def schedule_task(self, description: str, cron: str,
                     priority: TaskPriority = TaskPriority.MEDIUM,
                     handler: Optional[Callable] = None) -> str:
        """Schedule a recurring task (placeholder for cron)"""
        # For now, just create immediate task
        # Full cron support would require a separate scheduler
        task = self.create_task(description, priority, handler)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Most of the descriptive content and headings are presented in Chinese, which imposes a language preference in the user-facing skill documentation without explicit opt-in or justification. The policy rule allows locale constraints only when users are given a choice or the restriction is clearly documented as intentional and necessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code file performs a file write via Path(path).write_text(...) to persist scheduler state, but there is no confirmation prompt and no visible user-facing log or warning at the write site. Although the function has a brief docstring, it does not clearly disclose to the user that task data will be serialized and written to the filesystem at the provided path.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified as websockets>=11.0.0, which allows any newer release to be installed without review. This weakens supply-chain control and reproducibility, and can unintentionally pull in breaking or vulnerable versions over time. In a task scheduler with WebSocket-based real-time updates, that network-facing library is part of the attack surface, so version drift is more risky than in a purely offline component.

Content

Scanner excerpt · requirements.txt (reported line 7)May include surrounding context.

text

# asyncio (built-in in Python 3.7+)

# WebSocket support
websockets>=11.0.0

# Cron parsing for scheduled tasks
# python-crontab>=2.6.0

Unverifiable Dependency: websockets has 4 known advisory(ies) (CVE-2018-1000518 (websockets is vulnerable to denial of service by memory exhaustion); CVE-2021-33880 (Observable Timing Discrepancy in aaugustin websockets library); CVE-2018-1000518 (aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly C) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The manifest references websockets without pinning an exact version, while known advisories exist for some releases of that package. Because the installed version is not fixed, deployments may resolve to an affected release or behave inconsistently across environments; for a WebSocket-enabled task scheduler, this is especially relevant because the library is directly exposed to remote clients and could enable denial-of-service or similar network-driven attacks if a vulnerable version is used.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.