T06 · System Persistence
Error
- Location
- SKILL.md:85
- Finding
- Recurring Heartbeat Jobs Enable Persistent Autonomous Agent Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:85-92` **Additional Location**: `references/multi-agent-architecture.md:194-210` **Vulnerability Type**: Persistent scheduled execution **Risk Level**: High ### Vulnerable Code ```bash openclaw cron add \ --name "agent-heartbeat" \ --cron "0,15,30,45 * * * *" \ --session "isolated" \ --message "You are <AgentName>, the <Role>. Read WORKING.md. Check Mission Control for @mentions and assigned tasks. If work exists, do it and update WORKING.md. If nothing to do, reply HEARTBEAT_OK." ``` The architecture reference also recommends configuring each independent agent with its own recurring heartbeat: ```text Each heartbeat creates an **isolated session** (one-shot). Avoids always-on costs. ``` ### Technical Analysis The Skill instructs users to register recurring cron jobs that launch isolated agent sessions every 15 minutes. The scheduled instruction authorizes each agent to retrieve work from persistent files and Mission Control and to execute that work without requiring a new user request. Although recurring heartbeats are part of the documented architecture, they create a cross-session persistence mechanism. The scheduled job remains active after the original configuration session ends and repeatedly grants the agent opportunities to use its configured filesystem, shell, browser, and database capabilities. No mandatory expiration, execution budget, approval gate, or removal procedure is included. Consequently, a stale, compromised, or unexpectedly modified task source can continue triggering autonomous activity. ### Attack Path 1. A user follows the Skill and registers the recommended heartbeat cron job. 2. The cron configuration survives the original Skill invocation. 3. Every 15 minutes, OpenClaw creates a new isolated agent session. 4. The scheduled instruction directs the agent to read persistent state and query Mission Control. 5. A malicious, compromised, or incorrectly auth ...[truncated 1015 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make heartbeat installation explicitly opt-in rather than part of the default setup. 2. Require users to define an expiration time, maximum number of executions, and resource budget for every scheduled agent. 3. Add an approval gate before shell execution, file modification, external communication, or other consequential actions. 4. Restrict heartbeat sessions to the minimum required tools; routine status checks should not receive shell, process, or browser access. 5. Validate task origin and authorization before treating Mission Control records as executable work. 6. Provide commands to list, disable, and permanently remove all installed heartbeat jobs. 7. Log every wake-up, retrieved task, tool invocation, and resulting state change to an append-only audit trail. 8. Implement rate limits and a failure threshold that automatically disables a heartbeat after repeated errors or suspicious tasks. ]]>