T06 · System Persistence
Error
- Location
- SKILL.md:23
- Finding
- Persistent Gateway Execution Through a Windows Scheduled Task## Vulnerability Details **File Location**: `SKILL.md`, lines 23-27 **Vulnerability Type**: `T06: System Persistence` **Risk Level**: High The following is an English rendering of the complete affected section: ```markdown ## Service Information - **Windows task name**: OpenClaw Gateway - **Startup method**: Automatically starts at boot - **Failure policy**: Automatically restarts after the process exits ``` Related installation instructions at lines 5-11 direct the user to run: ```bash openclaw gateway install ``` The documentation explicitly states that this installation requires administrator privileges. ### Technical Analysis The Skill directs a user to install OpenClaw Gateway as a Windows Scheduled Task. The task starts automatically when Windows boots and restarts the Gateway whenever its process exits. This creates execution persistence across system reboots and user sessions. Scheduled Tasks are a recognized persistence mechanism because they allow a configured executable to run automatically under the task's assigned security principal. Requiring administrator privileges increases the security significance of the installation. If the Gateway executable, its configuration, its plugins, or a path it loads from is later compromised, attacker-controlled behavior could inherit the persistent execution context of the installed task. No evidence of hidden scripts, remote payload retrieval, credential theft, obfuscation, or data exfiltration was found. The persistence behavior is openly documented, but it still falls within the system-persistence classification. ### Attack Path 1. A user follows the Skill and opens a privileged administrative environment. 2. The user executes `openclaw gateway install`. 3. OpenClaw creates the `OpenClaw Gateway` Windows Scheduled Task. 4. The task launches the Gateway automatically during system startup. 5. If the Gateway process terminates, the configured failure p ...[truncated 942 chars]
- Remediation
- ## Remediation Suggestions 1. Do not install the Gateway as an automatically starting Scheduled Task by default. Prefer foreground or explicitly user-initiated execution. 2. Require clear, informed confirmation before creating any persistent task, and display the task name, executable path, arguments, working directory, trigger, restart policy, and security principal. 3. Run the Gateway under a dedicated least-privileged service account rather than an administrator or `SYSTEM` account unless elevated privileges are strictly required. 4. Restrict modification permissions on the Gateway executable, configuration files, plugin directories, and task definition to trusted administrators. 5. Use absolute, securely quoted paths for the task action and avoid loading executables or configuration from user-writable or temporary directories. 6. Provide and document a verified uninstall command or Scheduled Task removal procedure so users can fully disable persistence. 7. Apply bounded restart behavior with retry limits and backoff rather than unconditional restart after every process exit. 8. Record task creation and execution in auditable logs, and monitor unexpected changes to the task action, principal, executable, and configuration. 9. Digitally verify or otherwise integrity-check the Gateway executable and extensions before each upgrade or persistent deployment.