T06 · System Persistence
Warning
- Location
- docs/INSTALLATION.md:289
- Finding
- Optional Cron Configuration Creates Persistent Hourly Execution## Vulnerability Details **File Location**: `docs/INSTALLATION.md`, lines 289–293; duplicated in the translated section at lines 524–528 **Vulnerability Type**: Unnecessary scheduled-task persistence **Risk Level**: Medium ```bash # Check usage every hour crontab -e # Add: 0 * * * * bash ~/.openclaw/skills/glm-plan-usage/scripts/query-usage.sh >> ~/.glm-usage.log ``` ### Technical Analysis The installation guide recommends adding an hourly cron task that persists beyond the current Skill invocation. Persistent scheduling is not necessary for the Skill's declared on-demand usage-query functionality. The scheduled command repeatedly executes a mutable script from the user's home directory and appends its output to `~/.glm-usage.log`. The documentation does not provide: - A retention or rotation policy for the log. - Explicit restrictive permissions for the log. - Integrity protection or version pinning for the scheduled script. - Instructions for removing the cron entry during uninstallation. Although the cron task is optional and requires explicit user action, it expands the Skill's execution lifetime and attack surface beyond the minimum privileges and persistence needed for an on-demand monitoring tool. ### Attack Path 1. The user follows the optional installation instructions and adds the cron entry. 2. Cron executes `query-usage.sh` every hour under the user's account. 3. A malicious update, compromised installation source, or local attacker modifies the script at the same path. 4. The modified script is subsequently executed automatically without another explicit Skill invocation. 5. The replacement code obtains the permissions and accessible resources of the affected user account. 6. Usage output also continues accumulating in `~/.glm-usage.log`, potentially exposing historical account activity to processes or users that can read the file. ### Impact Assessment A successful script replacement could execute arbitrary commands with the privileges o ...[truncated 357 chars]
- Remediation
- ## Remediation Suggestions - Remove the cron recommendation from the default installation process, or place it in a clearly separated, explicit opt-in automation section. - Explain that scheduling is unnecessary for normal on-demand operation. - Schedule a version-pinned or integrity-verified script rather than an unrestricted mutable path. - Create the log with permissions limited to its owner, such as mode `0600`. - Configure log rotation, a maximum size, and a retention period. - Redirect standard error explicitly and define behavior for failed requests. - Document how to inspect and remove the installed cron entry during uninstallation. - Prefer a platform monitoring mechanism that provides explicit enable, disable, status, and logging controls.