ClawHub
Back to skill

Security audit

unattended-task-pitfalls

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed hardening guide for scheduled agent tasks, with one notable but purpose-aligned caution around detached background commands.

Install only if you want your agent to use this operational playbook when designing or debugging scheduled tasks. Pay particular attention before applying the setsid/nohup pattern to destructive, publishing, upload, or deletion workflows; add explicit stop procedures, logs, idempotency checks, and time limits for those jobs.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Session Persistence

Medium
Category
Rogue Agent
Content
### §2.1 后台化（防进程被杀）
- 长任务（打包/上传/批量处理）禁止在前台直接跑：平台网关常有 2-10 分钟超时，超时杀进程 → 留下半成品文件
- 标准模式：`setsid nohup <cmd> > /tmp/task.log 2>&1 &`，然后轮询日志/文件时间戳确认进度
- 佐证数据：同一个备份脚本，前台跑两次两次被杀，后台跑零事故

### §2.2 半成品的危害大于失败
Confidence
80% confidence
Finding
`nohup` is recommended here as part of a persistence pattern for unattended shell execution. Although the intent is reliability, it reduces operator control and can mask continued execution after a tool timeout or disconnect, which is risky in agent systems that may issue commands with destructive side effects.

Session Persistence

Medium
Category
Rogue Agent
Content
### §2.1 后台化（防进程被杀）
- 长任务（打包/上传/批量处理）禁止在前台直接跑：平台网关常有 2-10 分钟超时，超时杀进程 → 留下半成品文件
- 标准模式：`setsid nohup <cmd> > /tmp/task.log 2>&1 &`，然后轮询日志/文件时间戳确认进度
- 佐证数据：同一个备份脚本，前台跑两次两次被杀，后台跑零事故

### §2.2 半成品的危害大于失败
Confidence
80% confidence
Finding
`nohup` is recommended here as part of a persistence pattern for unattended shell execution. Although the intent is reliability, it reduces operator control and can mask continued execution after a tool timeout or disconnect, which is risky in agent systems that may issue commands with destructive side effects.

Session Persistence

Medium
Category
Rogue Agent
Content
进程被杀不是"任务失败"，而是"任务产出了一个损坏的产物"。若下游逻辑（上传/清理/状态标记）不感知损坏，坏产物会流转进正式链路（本例：坏备份被上传到云端"永久保留"区）。

### §2.3 网关 504 ≠ 命令失败
- 工具调用层报 504 Gateway Timeout，**底层命令可能已经执行成功**（尤其 setsid 后台任务不受会话死亡影响）
- 正确处置：先 `ps` 查进程、查产物文件时间戳，确认实际状态再决定是否重发
- 危险反面案例：盲目重发副作用命令（删除/上传/发布）→ 重复执行事故
- 504 后重发的三个前置检查：进程在不在 / 产物变没变 / 任务是否幂等
Confidence
76% confidence
Finding
The guidance normalizes the idea that a command may continue running after the controlling session has died and advises checking process state before reissuing commands. In context this is operationally sensible, but it still documents a persistence mechanism that can keep side-effecting jobs alive outside normal conversational supervision, increasing blast radius if a task was misissued.

Static analysis

No suspicious patterns detected.