ClawHub
Back to skill

Security audit

cron-skills-session

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly about creating OpenClaw cron reminders, but it gives the agent persistent automation authority and gateway restart instructions without enough confirmation or rollback guidance.

Install only if you want Codex to directly manage OpenClaw cron jobs for you. Before using it, verify each job's schedule, message payload, enabled state, and removal path, and be aware that the workflow may restart the OpenClaw gateway.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The skill is explicitly designed to create recurring or one-shot persistent jobs that deliver future messages into the active user session. While that is its stated purpose, it still creates session persistence and scheduled re-entry behavior, which can be abused for unwanted automation, spam, or repeated prompting if used without tight user consent and visibility.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
## Instructions for the LLM

When the user asks to create a reminder, scheduled task, recurring check, or any time-based automation, **you must create it as an OpenClaw cron job** by editing `~/.openclaw/cron/jobs.json` directly. Do not suggest system cron (`crontab`), `at`, or any other mechanism. The OpenClaw cron system is the only correct method.

**Your exact workflow when the user requests a cron job:**

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs the agent to directly modify a persistent cron configuration file and restart the OpenClaw gateway, which are system-impacting actions, without requiring explicit user confirmation or presenting the operational risk. This can cause unintended persistence, disruption of running sessions, or service interruption if the file is malformed or the restart is mistimed.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The instruction to 'Never ask the user to edit the file themselves. Always do it completely.' pushes the agent toward autonomous execution of persistent system changes rather than keeping the user in the approval loop. In combination with file writes and service restart, this increases the chance of unauthorized or surprising actions being taken on the user's behalf.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
8. Restart the gateway: `openclaw gateway restart`
9. Confirm to the user that the job is active

Never ask the user to edit the file themselves. Always do it completely.

**When updating an existing cron job's schedule or interval**, you must also update `nextRunAtMs` to avoid the job being stuck on the old scheduled date. Compute it as:

Static analysis

No suspicious patterns detected.