auto-daily-summary

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:53 PM UTC
• Version: 1.0.1

Overview

This skill has a legitimate daily-summary purpose, but it creates persistent jobs for every agent and uses unsafe shell command construction that could run unintended local commands.

Review carefully before installing. Only run this in an environment where you are comfortable creating daily jobs for every OpenClaw agent, and prefer a fixed version that avoids shell=True, validates agent and timezone data, offers per-agent selection or dry-run, and documents how to remove the created cron jobs.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: scripts/setup_daily_summary_cron.py:143

Finding

Recurring Cross-Session Agent Jobs Create System Persistence

Content

View full analysis

Vulnerability Details

File Location: scripts/setup_daily_summary_cron.py, lines 143-160
Vulnerability Type: T06: System Persistence
Risk Level: High

python

cron_command = (
    f'openclaw cron add '
    f'--name "Daily Summary - {agent_id}" '
    f'--cron "30 23 * * *" '
    f'--tz "{timezone}" '
    f'--session isolated '
    f'--agent {agent_id} '
    f'--message "{message}" '
    f'--announce'
)

result = run_openclaw_command(cron_command)
if result and result.returncode == 0:
    print(f"✓ Daily Summary - {agent_id} created successfully")
    return True
else:
    print(f"✗ Failed to create cron job for {agent_id}")
    if result:
        print(f"Error: {result.stderr}")
    return False

Technical Analysis

The script invokes openclaw cron add to install a job that runs every day at 23:30. The job survives termination of the setup script and repeatedly starts an isolated agent session with instructions to inspect previous activity and write to the agent's persistent diary.

The main routine applies this operation to every agent returned by openclaw agents list --json. Although the documented purpose of the Skill discloses scheduled execution, the implementation creates persistent, cross-session behavior and does not require confirmation for each affected agent. It also lacks an automatic expiration period or an integrated removal operation.

Attack Path

1. A user runs setup_daily_summary_cron.py.
2. The script enumerates all configured OpenClaw agents and their workspaces.
3. It checks existing cron jobs using openclaw cron list --json.
4. For each agent not recognized as configured, it executes openclaw cron add.
5. The newly registered job remains active after the setup process exits.
6. At 23:30 every day, OpenClaw starts an isolated session for the affected agent and supplies the configured diary-writing instruction.
7. This continues inde ...[truncated 708 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit confirmation before creating any scheduled job and obtain separate approval for each affected agent.
2. Support an allowlist or command-line selection instead of configuring every discovered agent by default.
3. Print the exact schedule, agent, workspace, and message before installation.
4. Provide a corresponding uninstall operation that reliably identifies and removes every job created by this Skill.
5. Consider an expiration date, bounded execution count, or one-shot mode as the default behavior.
6. Assign a stable Skill-specific identifier to each generated job so that auditing and removal do not depend on message-text matching.
7. Document how users can list, disable, and remove the persistent jobs using the OpenClaw CLI.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup_daily_summary_cron.py:64

Finding

Shell Command Injection Through Untrusted Agent and Environment Metadata

Content

View full analysis

Vulnerability Details

File Location: scripts/setup_daily_summary_cron.py, lines 64-72 and 138-160
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Critical

python

def run_openclaw_command(command):
    """Execute openclaw CLI command and return output."""
    try:
        result = subprocess.run(
            command, 
            shell=True, 
            capture_output=True, 
            text=True, 
            timeout=30
        )
        return result

python

def create_cron_job(agent_id, workspace_path, timezone):
    """Create a cron job for the specified agent."""
    diary_path = f"{workspace_path}/memory/daily/YYYY-MM-DD.md"
    
    cron_command = (
        f'openclaw cron add '
        f'--name "Daily Summary - {agent_id}" '
        f'--cron "30 23 * * *" '
        f'--tz "{timezone}" '
        f'--session isolated '
        f'--agent {agent_id} '
        f'--message "{message}" '
        f'--announce'
    )
    
    result = run_openclaw_command(cron_command)

Technical Analysis

The implementation constructs a single command string with f-string interpolation and executes it with shell=True. The following externally sourced values are inserted without shell-safe argument handling:

• agent_id, obtained from openclaw agents list --json
• workspace_path, obtained from the same agent metadata and incorporated into message
• timezone, potentially obtained from /etc/timezone, timedatectl, or the TZ environment variable

agent_id is inserted as an unquoted shell token. Shell separators, redirections, substitutions, or whitespace in that value can terminate the intended argument and introduce additional commands. The name field, timezone, and message are enclosed only in double quotes; double quotes do not prevent command substitution, and embedded double quotes can terminate those argument boundaries. A ...[truncated 2384 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove shell=True and pass arguments as a sequence so no shell parser is involved:

   python

   command = [
       "openclaw", "cron", "add",
       "--name", f"Daily Summary - {agent_id}",
       "--cron", "30 23 * * *",
       "--tz", timezone,
       "--session", "isolated",
       "--agent", agent_id,
       "--message", message,
       "--announce",
   ]
   
   subprocess.run(
       command,
       shell=False,
       capture_output=True,
       text=True,
       timeout=30,
       check=False,
   )
   

2. Refactor run_openclaw_command to accept only argument lists rather than arbitrary command strings.

3. Validate agent IDs against the exact character set allowed by OpenClaw, rejecting unexpected whitespace, control characters, separators, and metacharacters.

4. Validate timezone values against an installed IANA timezone database, such as Python's zoneinfo.available_timezones().

5. Treat workspace paths as opaque data. Normalize them with pathlib.Path where appropriate, but do not rely on path normalization as a substitute for removing shell interpretation.

6. Validate the parsed JSON schema and require strings of reasonable length for agent IDs and workspace paths.

7. Use the same argument-list approach for the fixed openclaw agents list --json and openclaw cron list --json calls to ensure the command helper cannot later be reused insecurely.

8. Add regression tests containing spaces, quotes, substitutions, separators, and Unicode characters in metadata, verifying that they are passed as literal arguments and never evaluated.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Using shell=True on a command string that is assembled from external CLI output and environment-derived data enables tool parameter abuse and shell injection. Because this script enumerates agents and workspaces from openclaw and embeds them into another shell command, a malicious agent name or workspace path could inject extra flags or shell metacharacters, causing unauthorized command execution or creation of attacker-controlled cron jobs.

Content

Scanner excerpt · scripts/setup_daily_summary_cron.py (reported line 71)May include surrounding context.

python

def run_openclaw_command(command):
    """Execute openclaw CLI command and return output."""
    try:
        result = subprocess.run(
            command, 
            shell=True, 
            capture_output=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs users to run a setup script that creates cron jobs for all discovered agents, which is a persistent configuration change affecting future automated behavior. While the skill describes what it does, it does not prominently warn that execution will modify scheduler state across the environment, which can surprise users and reduce informed consent for automation with ongoing effects.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/setup_daily_summary_cron.py (reported line 37)May include surrounding context.

python

return tz
        
        # Try to get timezone from timedatectl (Linux)
        result = subprocess.run(['timedatectl', 'show', '--value', '--property=Timezone'], 
                              capture_output=True, text=True, timeout=5)
        if result.returncode == 0 and result.stdout.strip():
            return result.stdout.strip()

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

The helper executes arbitrary command strings with shell=True, which creates a command-injection sink. In this file, that sink is later fed with dynamically constructed values such as agent IDs, workspace paths, and timezone data, so malicious or malformed values can break quoting and execute unintended shell commands.

Content

Scanner excerpt · scripts/setup_daily_summary_cron.py (reported line 71)May include surrounding context.

python

def run_openclaw_command(command):
    """Execute openclaw CLI command and return output."""
    try:
        result = subprocess.run(
            command, 
            shell=True, 
            capture_output=True,

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup_daily_summary_cron.py (reported line 148)May include surrounding context.

python

def create_cron_job(agent_id, workspace_path, timezone):
    """Create a cron job for the specified agent."""
    # Use YYYY-MM-DD format instead of specific date
    diary_path = f"{workspace_path}/memory/daily/YYYY-MM-DD.md"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The scheduled message text is entirely in Chinese, which forces a specific language for downstream agent interaction. The file does not provide any user opt-in, locale selection, or justification that this skill is intended only for a Chinese-language environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup_daily_summary_cron.py (reported line 171)May include surrounding context.

python

print(f"✓ Daily Summary - {agent_id} created successfully")
        return True
    else:
        print(f"✗ Failed to create cron job for {agent_id}")
        if result:
            print(f"Error: {result.stderr}")
        return False

Static analysis

No suspicious patterns detected.