Dial A Cron

Stateful cron system for OpenClaw with persistent memory, change detection, smart routing, token budget tracking, and self-healing. Requires 'openclaw' and '...

Security Scan

The code implements the advertised stateful cron features, but metadata and runtime instructions are inconsistent with what the skill actually does—it can read arbitrary files, execute shell commands, call network endpoints, and shells out to external CLIs (openclaw/gog) that are not declared—creating real exfiltration and shell-injection risk unless you audit and lock down job configs.

Purpose & Capability

The name/description (stateful cron with diffs, routing, budgets, self-heal) match the included scripts. However the skill metadata declares no required binaries or credentials while the code explicitly shells out to external CLIs (openclaw and gog) and expects optional env vars (DAC_JOBS_DIR, DAC_STATE_DIR, DAC_LOG_DIR). Missing declared dependencies is an incoherence: an operator would reasonably expect required CLIs/credentials to be declared.

Instruction Scope

SKILL.md and preflight instructions instruct the agent/operator to run preflight and inject DAC_CONTEXT into LLM prompts. The preflight/diff engine can read arbitrary local files, run arbitrary commands, and fetch arbitrary HTTP URLs defined in job configs; those results can be placed into DAC_CONTEXT and routed to external webhooks or emailed. The runtime instructions therefore allow collection and transmission of local file contents and command outputs — scope is broader than a minimal cron wrapper and is high-risk unless job configs are strictly controlled.

Install Mechanism

No install spec (instruction-only) — the bundle contains Python scripts but nothing is downloaded or auto-executed by an installer. This lowers supply-chain risk; however consumers receive executable scripts that must be run locally and therefore must be audited before execution.

Credentials

The skill declares no required env vars or credentials, yet the code reads optional env vars (DAC_JOBS_DIR, DAC_STATE_DIR, DAC_LOG_DIR) and shells out to external CLIs that typically require credentials (openclaw, gog). It also accepts webhook URLs, file paths, and agent endpoints from job configs. The absence of declared dependencies/credentials is disproportionate and could mislead operators about runtime capabilities and privileges.

Persistence & Privilege

The skill persists state, logs, and memory under local directories (state/, memory/, logs/). 'always' is not set. Persisted files may contain sensitive outputs or carry data from jobs; this is expected for a stateful cron but operators should review storage locations and permissions.

Scan Findings in Context

[subprocess-shell-true] expected: The code needs to invoke commands and external CLIs (openclaw, gog, user commands), so subprocess usage is expected. However many calls use shell=True with values derived from job configs or outputs, which is a shell-injection risk if those fields are not strictly sanitized or trusted.

[http-network-io] expected: Diff engine and router make outbound HTTP(S) requests (urllib.request.urlopen and webhook POSTs). This aligns with the advertised 'diff http' and webhook routing features, but it enables requests to arbitrary URLs (including internal IPs) which can facilitate exfiltration if job configs are malicious or misconfigured.

[local-file-read] expected: Diffs support reading arbitrary files (file type diffs). That is expected for change-detection features, but it means local files (including sensitive ones) can be read and included in DAC_CONTEXT or routed externally if job configs point to them.

[writes-state-to-disk] expected: The skill persistently stores state, logs, and delivery history. This is consistent with a stateful cron but may capture sensitive outputs — review storage permissions and retention.

[missing-declared-deps] unexpected: Metadata declares no required binaries or env vars, but SKILL.md and code require openclaw and gog CLIs and read DAC_* env vars. The mismatch can hide runtime failures or unexpected privilege/credential usage.

[unsanitized-input-in-shell] unexpected: Several delivery and diff paths build shell commands embedding config values and message bodies (e.g., openclaw/gog calls) without escaping. Embedding untrusted job config fields or outputs into these shells risks command injection and should be treated as a serious concern unless inputs are validated or shell usage is avoided.

What to consider before installing

This skill appears to implement the advertised features but requires careful handling. Before installing: - Audit every job config (jobs/*.json). Pay special attention to 'diffs' (file paths, commands, URLs) and 'routes' (webhook URLs, target_id) and remove any targets you don't trust. - Treat job configs as privileged: do not point diffs at secrets or system files. Avoid command diffs unless you control the commands. - Run Dial-a-Cron in an isolated/containerized environment with egress controls; consider blocking outbound webhooks unless explicitly whitelisted. - Ensure openclaw and gog CLIs exist and run with least privilege; verify credential use for those tools. - Look for subprocess.run(..., shell=True) usages in the code (router.py, diff.py, others) and either sanitize/escape all inputs or modify code to use argument arrays (shell=False). - If you cannot audit and control job configs and network access, do not install in a production environment. If in doubt, run the scripts in a disposable VM/container and monitor network and file activity.

Stateful cron system with memory, change detection, smart delivery, token budget tracking, and self-healing.

Security & Review Requirements (per OpenClaw scanner)

This skill has broad I/O capabilities and is marked Suspicious (high confidence) by the OpenClaw scanner.

Before installing or using:

• Audit all job configs (especially diffs for file/command/HTTP reads and routes for webhook URLs, target_id).
• Run in an isolated environment with limited network access (consider denying outbound webhooks if you do not want potential exfiltration).
• Ensure openclaw and gog CLIs exist and run with least privilege.
• Whitelist HTTP targets and restrict diff file paths to specific safe directories. Avoid diffs on secrets or system files.
• The code uses subprocess.run(..., shell=True) with values from job configs and outputs — unsanitized fields could allow shell injection.
• The skill can read arbitrary local files, make HTTP requests (including to internal IPs), and post outputs to external endpoints.
• Persisted state/logs may contain sensitive data from jobs — review storage permissions.

Full scanner report is in references/security-review.md.

Only use if you have reviewed the code and trust the job configs.

Basic Usage

openclaw cron create --name my-job --command "your-command" --dial "state:yes,change-detection:yes,routing:telegram:error,slack:warning,budget:50000,self-heal:yes"

What it contains

• Persistent state and change detection
• Smart delivery routing (webhook, message, email, etc.)
• Token budget tracking
• Self-healing (retries, backoff, auto-pause)
• Preflight, diff, router, and state scripts
• Requires openclaw and gog CLIs (not declared in older versions — now explicit)

No credentials are requested, but the code can contact arbitrary endpoints if job configs allow it.

Installation

openclaw skills install dial-a-cron

Then review the scripts in scripts/ and all job configs before creating any scheduled jobs.

Security Notes (from scanner)

• The skill implements the advertised features but has disproportionate I/O for a simple cron wrapper.
• Missing declared dependencies (openclaw, gog) in older metadata.
• Potential for exfiltration of local file contents or command output via routes/webhooks.
• Shell command injection risk if job configs or outputs are not sanitized.
• Persistence of state/logs that may contain sensitive job output.

Review the code, restrict job configs, and run in an isolated environment with network controls.

Full details and the exact scanner report are in references/security-review.md.

Version: 1.0.1 (security audit and full disclosure) License: MIT-0

Clean, honest, and auditable. Review before use.