T06 · System Persistence
- Location
references/integration.md:8- Finding
Persistent Unattended Execution Through Recurring Scheduled Tasks
- Content
View full analysis
Vulnerability Details
File Location:
references/integration.md, lines 8-49
Vulnerability Type: Recurring scheduled-task persistence
Risk Level: HighVulnerable Code
bash ### Basic Daily Check # Check daily at 9 AM, auto-update LOW risk openclaw cron add \ --name "Smart Auto-Update (Daily)" \ --cron "0 9 * * *" \ --tz "Asia/Shanghai" \ --session isolated \ --wake now \ --deliver \ --message "Run smart update check" ### Weekly Full Update # Weekly on Sunday at 2 AM openclaw cron add \ --name "Smart Auto-Update (Weekly)" \ --cron "0 2 * * 0" \ --tz "Asia/Shanghai" \ --session isolated \ --wake now \ --deliver \ --message "Run weekly smart update check with detailed report" ### Security-Focused Check # Daily security check (high sensitivity) openclaw cron add \ --name "Security Auto-Update" \ --cron "0 3 * * *" \ --tz "Asia/Shanghai" \ --session isolated \ --wake now \ --deliver \ --message "Run security-focused smart update check"Technical Analysis
The integration guide instructs users to register daily and weekly OpenClaw cron jobs. These jobs survive the initiating Skill run and repeatedly launch the updater without requiring approval for each invocation.
Scheduled execution is related to the declared hands-off maintenance functionality, but the documented configuration creates persistent autonomous execution with update capabilities. This exceeds the privileges required for a one-time update check and materially increases the consequences of a compromised update source, erroneous AI risk assessment, or subsequent modification of the Skill.
The use of isolated sessions reduces session-state exposure but does not eliminate the persistence or autonomous update risks. The documentation also does not provide removal commands, expiration controls, source allowlists, or a mandatory approval gate before change ...[truncated 1390 chars]
- Remediation
View remediation
Remediation Suggestions
- Make one-shot, report-only checks the default behavior.
- Require explicit and informed user consent before registering any recurring task.
- Require human approval before every update installation, even when an update is classified as low risk.
- Separate update checking from update application so scheduled jobs cannot directly modify the environment.
- Provide documented commands to list, disable, and remove every scheduled task created by the Skill.
- Add expiration dates, maximum-run limits, and visible ownership metadata to scheduled tasks.
- Execute checks and installations under a dedicated least-privileged account.
- Restrict update sources using immutable allowlists and verify package signatures or cryptographic checksums.
- Record each scheduled invocation and update decision in an append-only audit log.
- Accurately declare scheduling and update privileges in
_meta.json, whose currentcapabilitiesandpermissionsarrays are empty.