T06 · System Persistence
Error
- Location
SKILL.md:28- Finding
Persistent Autonomous Execution Through a Daily Cron Job
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 28–39
Vulnerability Type: Persistent scheduled agent execution
Risk Level: HighVulnerable Code:
text ### 2. Create Cron Jobname: "auto-memory-dream" schedule: { kind: "cron", expr: "0 4 * * *", tz: "<user timezone>" } payload: { kind: "agentTurn", message: "Read skills/skills/openclaw-auto-dream-lite/references/dream-prompt.md and follow every step.", timeoutSeconds: 600 } sessionTarget: "isolated" delivery: { mode: "announce" }
text ### Technical Analysis The setup instructions create a persistent cron job that launches an autonomous agent turn every day. The scheduled task survives the original skill invocation and continues running without a new user request or per-run approval. Each invocation loads `references/dream-prompt.md`, reads daily memory logs, and writes to persistent files such as `MEMORY.md`, `MEMORY.md.pre-dream`, and files under `memory/`. Consequently, the scheduled task provides a recurring execution channel whose effective behavior depends on the prompt and workspace content available at execution time. Although the cron job and its intended purpose are disclosed, installing a cross-session scheduled agent task constitutes system persistence. If the referenced prompt or processed workspace content is subsequently modified or compromised, the scheduled task can repeatedly process that content and modify persistent memory without renewed authorization. ### Attack Path 1. A user installs or configures the skill according to `SKILL.md`. 2. The setup process creates the `auto-memory-dream` daily cron job. 3. At 04:00 each day, the cron scheduler initiates an isolated `agentTurn`. 4. The autonomous agent reads and follows `references/dream-prompt.md`. 5. The prompt directs the agent to read daily logs, back up and modify `MEMORY.md`, append consolidation markers, and maintain `memory/dream-log ...[truncated 934 chars]- Remediation
View remediation
Remediation Suggestions
- Do not install the cron job automatically. Make recurring scheduling a separate, explicit, opt-in action.
- Before installation, display the exact schedule, invoked prompt, filesystem scope, timeout, and expected modifications.
- Require informed user confirmation immediately before creating the scheduled task.
- Provide documented commands or controls to inspect, disable, and permanently remove the cron job.
- Prefer manual triggers such as “Dream now” for deployments that do not require unattended execution.
- If scheduling is necessary, replace the general autonomous agent turn with a narrowly constrained process that has access only to the required memory files.
- Pin or integrity-check the execution prompt so later unauthorized modifications cannot silently alter scheduled behavior.
- Validate that all resolved paths remain inside the intended workspace memory directory before reading or writing files.
- Record each scheduled invocation and its file modifications in an auditable log, and notify the user when execution occurs.
- Allow users to configure retention, execution frequency, and whether daily logs may be modified.