T06 · System Persistence
Warning
- Location
- SKILL.md:136
- Finding
- Unqualified Recommendation to Install a Persistent Background Service## Vulnerability Details **File Location**: `SKILL.md`, lines 136–137 **Vulnerability Type**: T06: System Persistence **Risk Level**: Medium **Complete Code Snippet**: ```markdown 2. **Daemon Persistence**: - Use `openclaw onboard --install-daemon` to keep the assistant running as a background service. ``` The same recommendation is duplicated in the Chinese localization at `SKILL_zh.md`, lines 139–140. ### Technical Analysis The Skill instructs users to run `openclaw onboard --install-daemon`, which installs OpenClaw as a persistent background service. A daemon may continue operating after the configuration session ends and can automatically restart across login sessions or system reboots, depending on the OpenClaw implementation. The instruction is presented as an unconditional recommendation for public or semi-public channel deployments. It does not require explicit informed consent, verification of the executable’s provenance, inspection of the generated service definition, least-privilege configuration, or confirmation of the service account and network exposure. Although the repository does not execute the command automatically and contains no embedded implementation of the daemon, generated guidance can induce a user or downstream agent with shell access to establish cross-session persistence. The persistence command therefore extends the effect of the Skill beyond its immediate configuration-generation task. ### Attack Path 1. A user requests configuration for Discord, WhatsApp, Telegram, or another public channel. 2. The Skill follows its mandatory public-channel recommendation and includes `openclaw onboard --install-daemon`. 3. The user or an automation agent executes the command without reviewing the installed service definition. 4. OpenClaw is registered as a persistent background service under the privileges of the executing account. 5. The service continues processing configured channels and data af ...[truncated 1028 chars]
- Remediation
- ## Remediation Suggestions - Do not recommend daemon installation unconditionally. Present it as an optional operational step requiring explicit user confirmation. - Explain that the service persists beyond the current session and may start automatically after login or reboot. - Require users to verify that the `openclaw` executable originates from an approved source and matches an expected version or integrity hash. - Instruct users to inspect the proposed service definition before enabling it, including the executable path, arguments, environment variables, working directory, restart policy, and network exposure. - Require installation under a dedicated, unprivileged service account with access limited to the necessary workspace and channel resources. - Explicitly warn against running the installation command with `sudo` or administrator privileges unless the official documentation establishes a justified requirement. - Provide platform-specific commands for checking service status, reviewing logs, disabling automatic startup, and completely uninstalling the daemon. - Keep channel credentials in a secrets manager or protected environment file rather than embedding them in generated Markdown. - Apply the same changes to `SKILL_zh.md` and ensure the localized file remains synchronized with the authoritative English instructions.