T06 · System Persistence
Error
- Location
SKILL.md:77- Finding
Privileged Persistent Execution Through Cron, Agent Schedulers, and systemd
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 77-100
Vulnerability Type: Persistent scheduled execution of unreviewed plugin components
Risk Level: HighVulnerable Code
markdown ## Runtime Support ### OpenClaw Plugin is linked to `~/.openclaw/plugins/crypto-signals-plugin`. Scheduling is done via **system cron**: ```cron */30 * * * * ~/.gemini/config/plugins/crypto-signals-plugin/scripts/run-cycle.sh */5 * * * * ~/.gemini/config/plugins/crypto-signals-plugin/scripts/watchdog.sh 0 9 * * 1 ~/.gemini/config/plugins/crypto-signals-plugin/scripts/run-cycle.sh weekly-summaryHermes Agent
Plugin is linked to
~/.hermes/skills/crypto-signals-plugin. Scheduling is done via Hermes built-in scheduler:bash hermes schedule add --name crypto-signals-cycle --cron "*/30 * * * *" --skill crypto-signals-plugin/crypto-signals-router hermes schedule add --name crypto-signals-watchdog --cron "*/5 * * * *" --skill crypto-signals-plugin/watchdog hermes schedule add --name crypto-signals-weekly --cron "0 9 * * 1" --skill crypto-signals-plugin/channel-captainPersistent Linux Service (optional, either runtime)
bash # Install systemd timer for watchdog (more reliable than cron) sudo cp ~/.gemini/config/plugins/crypto-signals-plugin/config/crypto-signals-watchdog.{service,timer} /etc/systemd/system/ sudo systemctl enable --now crypto-signals-watchdog.timertext ### Technical Analysis The Skill directs users to register multiple cross-session scheduled tasks. It also offers an installation path that copies service definitions from a user-controlled plugin directory into `/etc/systemd/system/` with `sudo` and immediately enables the timer. Persistent scheduling is consistent with the declared goal of continuous operation, but the system-wide systemd installation exceeds the minimum privileges needed for periodic user-level processing. A user-level syst ...[truncated 2681 chars]- Remediation
View remediation
Remediation Suggestions
- Do not install system-wide services by default. Use the existing runtime scheduler or a user-level systemd timer under
~/.config/systemd/user/. - Include all referenced scripts and unit definitions in the audited package so their commands, environment, permissions, and network behavior can be reviewed before registration.
- Require explicit, informed operator consent before creating any persistent task. Display the complete timer and service contents before installation.
- Separate installation from activation. Do not combine copying a unit with immediate
enable --nowbehavior. - If a system service is strictly necessary, configure an explicit dedicated unprivileged account using
User=andGroup=. - Apply systemd hardening controls such as
NoNewPrivileges=true,PrivateTmp=true,ProtectSystem=strict,ProtectHome=true, restricted writable paths, and narrowly scoped network access. - Ensure scheduled scripts and parent directories are not writable by less-trusted users. Validate ownership and restrictive permissions before every activation.
- Use absolute, immutable executable paths and verify package integrity or signatures before registration.
- Keep wallet keys and Telegram tokens out of service files and command lines. Load them from a restricted secret manager or a file owned by the service account with mode
0600. - Document complete removal procedures for cron entries, Hermes schedules, timers, service files, and daemon reloads.
- Do not install system-wide services by default. Use the existing runtime scheduler or a user-level systemd timer under