ClawHub
Back to skill

Security audit

Cron Gate

Security checks for vulnerabilities and agentic risk

Overview

Cron Gate is a disclosed scheduler helper that reads local OpenClaw session timestamps and triggers configured local crons only when activity changed.

Install only if you are comfortable adding a system crontab entry that can trigger existing OpenClaw crons automatically. Review the SESSION_CRONS mappings carefully, test with --dry-run first, and remove the crontab entry if you no longer want background triggering.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Content
� even when there's nothing new to process. If you run memory integration across 5 sessions twice a day, that's 10 LLM wake-ups. Most of them find nothing and go back to sleep, having burned ~40K tokens each.

Cron Gate is a zero-token Python gatekeeper that checks for new activity *before* triggering expensive LLM crons. No new messages? No wake-up. No tokens burned.

## How It Works

```
System crontab (free)          OpenClaw cron (expensive)
        │                              │
   gate.py runs              disabled, waiting
        │                              │
   checks sessions.json       ┌───────┘
        │                     │
   new activity? ─── yes ───► triggers cron via API
        │
       no ──► exits silently (0 tokens)
```

1. A lightweight Python script runs on system crontab (zero LLM cost)
2. It reads `sessions.json` to check `updatedAt` timestamps
3. Compares against its own state file (last time it trigger
Confidence
75% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
To reset (re-trigger everything on next run):
```bash
rm /opt/scripts/cron-gate-state.json
```

## Token Savings
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Session Persistence

Medium
Category
Rogue Agent
Content
- Python 3.8+
- OpenClaw with gateway API running on localhost:18789
- System crontab access (`crontab -e`)
- No additional dependencies (stdlib only)
Confidence
85% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.