auto-daily-summary

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:53 PM UTC
• Version: 1.0.1

Overview

This skill has a legitimate daily-summary purpose, but it creates persistent jobs for every agent and uses unsafe shell command construction that could run unintended local commands.

Review carefully before installing. Only run this in an environment where you are comfortable creating daily jobs for every OpenClaw agent, and prefer a fixed version that avoids shell=True, validates agent and timezone data, offers per-agent selection or dry-run, and documents how to remove the created cron jobs.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: scripts/setup_daily_summary_cron.py:143
• Finding: Recurring Cross-Session Agent Jobs Create System Persistence## Vulnerability Details **File Location**: `scripts/setup_daily_summary_cron.py`, lines 143-160 **Vulnerability Type**: T06: System Persistence **Risk Level**: High ```python cron_command = ( f'openclaw cron add ' f'--name "Daily Summary - {agent_id}" ' f'--cron "30 23 * * *" ' f'--tz "{timezone}" ' f'--session isolated ' f'--agent {agent_id} ' f'--message "{message}" ' f'--announce' ) result = run_openclaw_command(cron_command) if result and result.returncode == 0: print(f"✓ Daily Summary - {agent_id} created successfully") return True else: print(f"✗ Failed to create cron job for {agent_id}") if result: print(f"Error: {result.stderr}") return False ``` ### Technical Analysis The script invokes `openclaw cron add` to install a job that runs every day at 23:30. The job survives termination of the setup script and repeatedly starts an isolated agent session with instructions to inspect previous activity and write to the agent's persistent diary. The main routine applies this operation to every agent returned by `openclaw agents list --json`. Although the documented purpose of the Skill discloses scheduled execution, the implementation creates persistent, cross-session behavior and does not require confirmation for each affected agent. It also lacks an automatic expiration period or an integrated removal operation. ### Attack Path 1. A user runs `setup_daily_summary_cron.py`. 2. The script enumerates all configured OpenClaw agents and their workspaces. 3. It checks existing cron jobs using `openclaw cron list --json`. 4. For each agent not recognized as configured, it executes `openclaw cron add`. 5. The newly registered job remains active after the setup process exits. 6. At 23:30 every day, OpenClaw starts an isolated session for the affected agent and supplies the configured diary-writing instruction. 7. This continues inde ...[truncated 708 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit confirmation before creating any scheduled job and obtain separate approval for each affected agent. 2. Support an allowlist or command-line selection instead of configuring every discovered agent by default. 3. Print the exact schedule, agent, workspace, and message before installation. 4. Provide a corresponding uninstall operation that reliably identifies and removes every job created by this Skill. 5. Consider an expiration date, bounded execution count, or one-shot mode as the default behavior. 6. Assign a stable Skill-specific identifier to each generated job so that auditing and removal do not depend on message-text matching. 7. Document how users can list, disable, and remove the persistent jobs using the OpenClaw CLI.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup_daily_summary_cron.py:64
• Finding: Shell Command Injection Through Untrusted Agent and Environment Metadata## Vulnerability Details **File Location**: `scripts/setup_daily_summary_cron.py`, lines 64-72 and 138-160 **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Critical ```python def run_openclaw_command(command): """Execute openclaw CLI command and return output.""" try: result = subprocess.run( command, shell=True, capture_output=True, text=True, timeout=30 ) return result ``` ```python def create_cron_job(agent_id, workspace_path, timezone): """Create a cron job for the specified agent.""" diary_path = f"{workspace_path}/memory/daily/YYYY-MM-DD.md" cron_command = ( f'openclaw cron add ' f'--name "Daily Summary - {agent_id}" ' f'--cron "30 23 * * *" ' f'--tz "{timezone}" ' f'--session isolated ' f'--agent {agent_id} ' f'--message "{message}" ' f'--announce' ) result = run_openclaw_command(cron_command) ``` ### Technical Analysis The implementation constructs a single command string with f-string interpolation and executes it with `shell=True`. The following externally sourced values are inserted without shell-safe argument handling: - `agent_id`, obtained from `openclaw agents list --json` - `workspace_path`, obtained from the same agent metadata and incorporated into `message` - `timezone`, potentially obtained from `/etc/timezone`, `timedatectl`, or the `TZ` environment variable `agent_id` is inserted as an unquoted shell token. Shell separators, redirections, substitutions, or whitespace in that value can terminate the intended argument and introduce additional commands. The name field, timezone, and message are enclosed only in double quotes; double quotes do not prevent command substitution, and embedded double quotes can terminate those argument boundaries. A ...[truncated 2384 chars]
• Remediation: ## Remediation Suggestions 1. Remove `shell=True` and pass arguments as a sequence so no shell parser is involved: ```python command = [ "openclaw", "cron", "add", "--name", f"Daily Summary - {agent_id}", "--cron", "30 23 * * *", "--tz", timezone, "--session", "isolated", "--agent", agent_id, "--message", message, "--announce", ] subprocess.run( command, shell=False, capture_output=True, text=True, timeout=30, check=False, ) ``` 2. Refactor `run_openclaw_command` to accept only argument lists rather than arbitrary command strings. 3. Validate agent IDs against the exact character set allowed by OpenClaw, rejecting unexpected whitespace, control characters, separators, and metacharacters. 4. Validate timezone values against an installed IANA timezone database, such as Python's `zoneinfo.available_timezones()`. 5. Treat workspace paths as opaque data. Normalize them with `pathlib.Path` where appropriate, but do not rely on path normalization as a substitute for removing shell interpretation. 6. Validate the parsed JSON schema and require strings of reasonable length for agent IDs and workspace paths. 7. Use the same argument-list approach for the fixed `openclaw agents list --json` and `openclaw cron list --json` calls to ensure the command helper cannot later be reused insecurely. 8. Add regression tests containing spaces, quotes, substitutions, separators, and Unicode characters in metadata, verifying that they are passed as literal arguments and never evaluated.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def run_openclaw_command(command):
    """Execute openclaw CLI command and return output."""
    try:
        result = subprocess.run(
            command, 
            shell=True, 
            capture_output=True,

• Confidence: 99% confidence
• Finding: Using shell=True on a command string that is assembled from external CLI output and environment-derived data enables tool parameter abuse and shell injection. Because this script enumerates agents and workspaces from openclaw and embeds them into another shell command, a malicious agent name or workspace path could inject extra flags or shell metacharacters, causing unauthorized command execution or creation of attacker-controlled cron jobs.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs users to run a setup script that creates cron jobs for all discovered agents, which is a persistent configuration change affecting future automated behavior. While the skill describes what it does, it does not prominently warn that execution will modify scheduler state across the environment, which can surprise users and reduce informed consent for automation with ongoing effects.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return tz
        
        # Try to get timezone from timedatectl (Linux)
        result = subprocess.run(['timedatectl', 'show', '--value', '--property=Timezone'], 
                              capture_output=True, text=True, timeout=5)
        if result.returncode == 0 and result.stdout.strip():
            return result.stdout.strip()

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_openclaw_command(command):
    """Execute openclaw CLI command and return output."""
    try:
        result = subprocess.run(
            command, 
            shell=True, 
            capture_output=True,

• Confidence: 98% confidence
• Finding: The helper executes arbitrary command strings with shell=True, which creates a command-injection sink. In this file, that sink is later fed with dynamically constructed values such as agent IDs, workspace paths, and timezone data, so malicious or malformed values can break quoting and execute unintended shell commands.

Session Persistence

Medium

• Category: Rogue Agent

Content

def create_cron_job(agent_id, workspace_path, timezone):
    """Create a cron job for the specified agent."""
    # Use YYYY-MM-DD format instead of specific date
    diary_path = f"{workspace_path}/memory/daily/YYYY-MM-DD.md"

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The scheduled message text is entirely in Chinese, which forces a specific language for downstream agent interaction. The file does not provide any user opt-in, locale selection, or justification that this skill is intended only for a Chinese-language environment.

Session Persistence

Medium

• Category: Rogue Agent

Content

print(f"✓ Daily Summary - {agent_id} created successfully")
        return True
    else:
        print(f"✗ Failed to create cron job for {agent_id}")
        if result:
            print(f"Error: {result.stderr}")
        return False

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.