Linux Cron Panel

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:53 AM UTC
• Version: 1.2.0

Overview

This cron-management skill is mostly transparent about its purpose, but it automatically installs and keeps running unverified third-party code.

Review carefully before installing. This skill should only be used if you are comfortable letting it clone and run the referenced GitHub project, create a user-level systemd service, and manage scheduled commands on your machine. Prefer a pinned and verified release, require explicit approval before service installation, deletion, or run-now actions, and make sure you know how to disable and remove the service.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:23
• Finding: Unpinned Remote Repository Is Retrieved and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 23-58 **Vulnerability Type**: Unverified remote payload retrieval and execution **Risk Level**: High ```bash if [ -d "$HOME/.openclaw/linux-cron-panel" ]; then # 已安装，启动服务 cd "$HOME/.openclaw/linux-cron-panel" bash start.sh else # 未安装，执行安装 git clone https://github.com/wdmywm3/linux-cron-panel.git "$HOME/.openclaw/linux-cron-panel" # 配置 systemd 服务 mkdir -p "$HOME/.config/systemd/user" cat > "$HOME/.config/systemd/user/linux-cron-panel.service" << 'SERVICE_EOF' [Unit] Description=Linux Cron Panel API Service After=network.target [Service] Type=forking WorkingDirectory=%h/.openclaw/linux-cron-panel ExecStart=bash start.sh Restart=always RestartSec=10 TimeoutStopSec=30 [Install] WantedBy=default.target SERVICE_EOF # 启动服务 systemctl --user daemon-reload systemctl --user enable --now linux-cron-panel fi ``` ### Technical Analysis The installation procedure clones a mutable third-party GitHub repository and executes its `start.sh` script without pinning an immutable commit, validating a cryptographic checksum, or verifying a trusted signature. Both the direct `bash start.sh` invocation and the systemd `ExecStart` directive execute files controlled by that external repository. Consequently, the effective code executed by the Skill can change after the Skill itself has been reviewed. Compromise of the upstream account, repository, release process, DNS/TLS trust chain, or a malicious upstream update could turn the installation process into arbitrary code execution. The existing-directory branch also executes the local `start.sh` without confirming its integrity. A previously modified checkout could therefore be executed again. ### Attack Path 1. An attacker compromises the referenced GitHub repository or gains permission to modify its default branch. 2. The attacker modifies `start.sh` or another file invoked by it to contain a malicious payload. 3. A user invokes the Ski ...[truncated 994 chars]
• Remediation: ## Remediation Suggestions 1. Do not clone and execute the mutable default branch. Pin installation to a reviewed, immutable commit hash or a specific signed release. 2. Verify downloaded content using a cryptographic checksum obtained through a trusted channel, or require a valid signature from an explicitly trusted maintainer key. 3. Vendor the minimum reviewed implementation into the package where feasible, allowing the executed code to be audited together with the Skill. 4. Require explicit user confirmation before downloading or executing third-party code. 5. Execute the service with a dedicated, minimally privileged account or a strongly sandboxed user service. 6. Add systemd hardening controls appropriate to the application, such as `NoNewPrivileges=yes`, `PrivateTmp=yes`, `ProtectSystem=strict`, `ProtectHome=read-only`, and narrowly scoped `ReadWritePaths`. 7. Before executing an existing installation, verify that its commit and relevant file hashes match the approved version. 8. Document the precise external code being trusted and provide a controlled update process rather than silently consuming upstream changes.

T06 · System Persistence

Error

• Location: SKILL.md:32
• Finding: Automatic Installation of a Persistent User Service## Vulnerability Details **File Location**: `SKILL.md`, lines 32-56 **Vulnerability Type**: Cross-session system persistence **Risk Level**: High ```bash # 配置 systemd 服务 mkdir -p "$HOME/.config/systemd/user" cat > "$HOME/.config/systemd/user/linux-cron-panel.service" << 'SERVICE_EOF' [Unit] Description=Linux Cron Panel API Service After=network.target [Service] Type=forking WorkingDirectory=%h/.openclaw/linux-cron-panel ExecStart=bash start.sh Restart=always RestartSec=10 TimeoutStopSec=30 [Install] WantedBy=default.target SERVICE_EOF # 启动服务 systemctl --user daemon-reload systemctl --user enable --now linux-cron-panel ``` ### Technical Analysis The Skill creates a user-level systemd unit, configures it with `Restart=always`, and enables it through `systemctl --user enable --now`. This causes the external panel code to run beyond the immediate Skill invocation and to restart automatically after failures and across applicable user sessions. A persistent service is related to the declared web-based cron-management functionality, but automatic enablement is not the minimum privilege or persistence necessary to perform individual cron-management operations. An on-demand process could provide the same core functionality without establishing cross-session execution. The risk is amplified because the persistent executable is sourced from an unpinned remote repository. There are also no documented consent, integrity-verification, sandboxing, disablement, or uninstall procedures. ### Attack Path 1. The Skill clones or uses the panel repository in `~/.openclaw/linux-cron-panel`. 2. It writes `linux-cron-panel.service` into the user's systemd configuration. 3. It enables and immediately starts the unit. 4. The unit executes `bash start.sh` and uses `Restart=always` to relaunch the process. 5. If the repository is malicious or later modified locally, the altered code is run under the persistent service. 6. The service continues operating after the original S ...[truncated 668 chars]
• Remediation: ## Remediation Suggestions 1. Start the panel on demand by default and stop it when the requested management operation is complete. 2. Require explicit, informed user approval before creating or enabling any persistent systemd unit. 3. Separate installation, one-time execution, and persistence into distinct documented actions. 4. If persistence is approved, pin and verify the executable code before registering the service. 5. Apply systemd sandboxing and least-privilege restrictions, including filesystem, network, capability, and writable-path constraints. 6. Avoid `Restart=always` unless continuous availability is explicitly required; use a bounded restart policy where appropriate. 7. Provide complete removal instructions, including: - `systemctl --user disable --now linux-cron-panel` - Removal of `~/.config/systemd/user/linux-cron-panel.service` - `systemctl --user daemon-reload` - Optional removal of the installed repository and generated data after user confirmation. 8. Clearly disclose the service's lifetime, startup behavior, listening interface, authentication model, and accessible command-execution capabilities before installation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to clone and install third-party code, create a persistent user-level systemd service, and start it automatically, but does not require explicit user approval or present the persistence and supply-chain risks. In an agent context, these steps materially change the host state and establish long-lived execution, which could be abused if the repository is compromised or if the action is triggered unexpectedly.

External Transmission

Medium

• Category: Data Exfiltration

Content

**步骤 1：检查服务是否运行**
```bash
curl -sS http://127.0.0.1:5002/api/version
```
如果返回 JSON 版本信息，说明服务正常，直接使用。如果连接失败，继续下一步。

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

git clone https://github.com/wdmywm3/linux-cron-panel.git "$HOME/.openclaw/linux-cron-panel"
  
  # 配置 systemd 服务
  mkdir -p "$HOME/.config/systemd/user"
  cat > "$HOME/.config/systemd/user/linux-cron-panel.service" << 'SERVICE_EOF'
[Unit]
Description=Linux Cron Panel API Service

• Confidence: 97% confidence
• Finding: Writing a service definition into ~/.config/systemd/user creates a persistence mechanism that causes the installed software to be managed as a recurring background service. This is especially sensitive in an agent skill because it modifies startup behavior and can keep third-party code running beyond the immediate user request.

Session Persistence

Medium

• Category: Rogue Agent

Content

# 启动服务
  systemctl --user daemon-reload
  systemctl --user enable --now linux-cron-panel
fi
```

• Confidence: 98% confidence
• Finding: Enabling a user systemd service with systemctl --user enable --now establishes persistence across future sessions and immediately launches the service. In a skill, persisting background software without an explicit consent boundary is dangerous because it creates ongoing execution and a durable foothold tied to external code.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 4. 创建任务
```bash
curl -sS -X POST http://127.0.0.1:5002/api/tasks \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "任务名称",

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 5. 编辑任务
```bash
curl -sS -X PUT http://127.0.0.1:5002/api/tasks/{id} \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "新名称",

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documented delete and immediate-run APIs can remove scheduled tasks or trigger execution of arbitrary configured commands on the host, yet the skill provides no caution or approval gate for these destructive and execution-triggering actions. In a cron-management skill, these operations are expected, but they remain dangerous because they can directly alter host automation or run commands immediately.

Session Persistence

Medium

• Category: Rogue Agent

Content

## 调用流程

1. **前置检查:** GET /api/version 验证服务运行
2. **创建脚本目录:** `mkdir -p ~/.openclaw/scripts`
3. **创建脚本:** 写入脚本并添加执行权限
4. **创建任务:** POST /api/tasks → 使用脚本路径作为 command
5. **验证:** GET /api/tasks/{id} 确认任务状态

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.