T06 · System Persistence
Error
- Location
scripts/birthday_manager.py:383- Finding
Automatic Creation of a Persistent Scheduled Task
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:129-139,scripts/birthday_manager.py:383-397 and 531-533,scripts/birthday_manager.js:418-430 and 586-588
Vulnerability Type: Scheduled-task persistence
Risk Level: HighThe skill directs the invoking agent to create an active recurring automation after the first birthday record is added. Both script implementations generate the automation payload automatically when they detect an OpenClaw or Codex environment.
Complete Code Snippets
SKILL.md:129-139markdown ## OpenClaw timer When the data file changes from zero records to one record and the script detects that the current environment is OpenClaw, it additionally outputs a line in the following format: OPENCLAW_AUTOMATION_SUGGESTION {...} The AI invoking this skill should read this JSON line and create a daily scheduled check automation for OpenClaw. The default recommendation is to execute `check` every day at 09:00.scripts/birthday_manager.py:383-397python def emit_openclaw_scheduler_hint(data_file: Path, notification_config: Path) -> None: current = str(Path.cwd()).lower() if "openclaw" not in current and "CODEX_HOME" not in os.environ: return hint = { "name": "Birthday reminder check", "prompt": ( f"Run python3 {Path(__file__).resolve()} --data-file {data_file} " f"--notification-config {notification_config} check and process the reminder output." ), "rrule": "FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR,SA,SU;BYHOUR=9;BYMINUTE=0", "cwds": str(Path(__file__).resolve().parents[1]), "status": "ACTIVE", } print(f"OPENCLAW_AUTOMATION_SUGGESTION {json.dumps(hint, ensure_ascii=False)}")scripts/birthday_manager.py:531-533python if result["first_add"]: emit_openclaw_scheduler_hint(args.data_file, args.notification_config)**` ...[truncated 3384 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the instruction in
SKILL.mdthat tells the agent to create an automation automatically from script output. - Stop emitting scheduler payloads as a side effect of adding the first birthday record.
- Introduce a separate, explicit command such as
scheduleorenable-automation. - Before creating a task, display the exact executable, arguments, working directory, cadence, data path, notification configuration, and outbound notification channels.
- Require explicit user confirmation immediately before scheduler creation; consent to add a birthday must not be treated as consent to establish persistence.
- Create proposed tasks in a disabled state by default and require a separate activation action.
- Validate and safely encode all file paths inserted into automation prompts so that user-selected paths cannot alter the intended command.
- Provide commands to list, disable, and permanently remove the scheduled task.
- Record the scheduler identifier so the task can be audited and reliably removed.
- Document the persistence lifetime, execution privileges, notification behavior, and data accessed by each scheduled run.
- Remove the instruction in