T06 · System Persistence
- Location
SKILL.md:133- Finding
Persistent Scheduled Agent Execution Without Lifecycle Controls
- Content
View full analysis
Vulnerability Details
File Locations:
SKILL.md:133-148references/config-guide.md:286-302assets/config-yaml.md:79-84
Vulnerability Type: Persistent scheduled-task creation
Risk Level: MediumVulnerable Code
SKILL.md:133-148:yaml ### Step 6: 配置 Cron 根据用户选择，自动配置 OpenClaw Cron 任务： cron: - name: morning-wisdom schedule: "0 8 * * *" action: "发送晨语" skill: daily-cultivation - name: evening-reflection schedule: "0 21 * * *" action: "发送晚复盘" skill: daily-cultivationreferences/config-guide.md:286-302:yaml ### OpenClaw Cron 格式 在 OpenClaw 配置中添加： cron: - name: morning-wisdom schedule: "0 8 * * *" # 每天 08:00 action: "发送晨语" skill: daily-cultivation - name: evening-reflection schedule: "0 22 * * *" # 每天 22:00 action: "发送晚复盘" skill: daily-cultivationassets/config-yaml.md:79-84:yaml # ===== 定时任务 ===== cron: morning: schedule: "0 8 * * *" evening: schedule: "0 22 * * *"Technical Analysis
The Skill directs the Agent to configure recurring OpenClaw Cron jobs during initialization. These scheduled jobs survive the interaction that created them and repeatedly invoke the Skill at fixed times.
Scheduled execution is consistent with the advertised reminder functionality, but the documented workflow lacks important lifecycle and authorization controls:
- No explicit confirmation is required immediately before persistent jobs are created.
- Scheduling is enabled in the example configuration by default.
- No expiration date, execution limit, or automatic cleanup is defined.
- No procedure is provided to list, disable, or remove installed jobs.
- The jobs are not explicitly bound to an immutable, previously approved delivery target.
- No reauthorization is required if the configured channel or referenced content changes later.
...[truncated 2221 chars]
- Remediation
View remediation
Remediation Suggestions
-
Require explicit approval before persistence
- Present each proposed job, schedule, timezone, action, and destination.
- Require a separate affirmative confirmation immediately before modifying OpenClaw configuration.
- Do not treat general agreement to receive reminders as authorization to install persistent jobs.
-
Use secure defaults
- Keep scheduling disabled by default in example configurations.
- Require users to opt in independently to morning and evening jobs.
- Prefer session-scoped or one-time reminders when persistent execution is unnecessary.
-
Implement lifecycle controls
- Support an expiration date, maximum execution count, or review interval.
- Document exact procedures for listing, pausing, and deleting every installed job.
- Assign stable identifiers so jobs can be reliably managed without affecting unrelated tasks.
-
Bind jobs to approved resources
- Store and verify the approved channel type and destination when creating the job.
- Require renewed authorization before changing the destination, vault, template, or other security-sensitive inputs.
- Restrict file access to a designated Skill workspace and validated Obsidian vault.
-
Validate configuration
- Validate schedules and timezones before installation.
- Canonicalize and constrain all configured paths.
- Reject path traversal, absolute paths outside approved roots, and symbolic-link escapes.
- Validate channel identifiers and avoid silently falling back to another destination.
-
Improve transparency and auditability
- Notify the user after a job is created, changed, disabled, or removed.
- Record job creation time, approving user, schedule, destination, and last execution status.
- Provide a visible indication in each automated message that it originated from a scheduled job.
-
Apply least privilege
- Run sch ...[truncated 264 chars]
-