T06 · System Persistence
Error
- Location
- scripts/birthday_manager.py:383
- Finding
- Automatic Creation of a Persistent Scheduled Task## Vulnerability Details **File Location**: `SKILL.md:129-139`, `scripts/birthday_manager.py:383-397 and 531-533`, `scripts/birthday_manager.js:418-430 and 586-588` **Vulnerability Type**: Scheduled-task persistence **Risk Level**: High The skill directs the invoking agent to create an active recurring automation after the first birthday record is added. Both script implementations generate the automation payload automatically when they detect an OpenClaw or Codex environment. ### Complete Code Snippets **`SKILL.md:129-139`** ```markdown ## OpenClaw timer When the data file changes from zero records to one record and the script detects that the current environment is OpenClaw, it additionally outputs a line in the following format: OPENCLAW_AUTOMATION_SUGGESTION {...} The AI invoking this skill should read this JSON line and create a daily scheduled check automation for OpenClaw. The default recommendation is to execute `check` every day at 09:00. ``` **`scripts/birthday_manager.py:383-397`** ```python def emit_openclaw_scheduler_hint(data_file: Path, notification_config: Path) -> None: current = str(Path.cwd()).lower() if "openclaw" not in current and "CODEX_HOME" not in os.environ: return hint = { "name": "Birthday reminder check", "prompt": ( f"Run python3 {Path(__file__).resolve()} --data-file {data_file} " f"--notification-config {notification_config} check and process the reminder output." ), "rrule": "FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR,SA,SU;BYHOUR=9;BYMINUTE=0", "cwds": str(Path(__file__).resolve().parents[1]), "status": "ACTIVE", } print(f"OPENCLAW_AUTOMATION_SUGGESTION {json.dumps(hint, ensure_ascii=False)}") ``` **`scripts/birthday_manager.py:531-533`** ```python if result["first_add"]: emit_openclaw_scheduler_hint(args.data_file, args.notification_config) ``` **` ...[truncated 3384 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction in `SKILL.md` that tells the agent to create an automation automatically from script output. 2. Stop emitting scheduler payloads as a side effect of adding the first birthday record. 3. Introduce a separate, explicit command such as `schedule` or `enable-automation`. 4. Before creating a task, display the exact executable, arguments, working directory, cadence, data path, notification configuration, and outbound notification channels. 5. Require explicit user confirmation immediately before scheduler creation; consent to add a birthday must not be treated as consent to establish persistence. 6. Create proposed tasks in a disabled state by default and require a separate activation action. 7. Validate and safely encode all file paths inserted into automation prompts so that user-selected paths cannot alter the intended command. 8. Provide commands to list, disable, and permanently remove the scheduled task. 9. Record the scheduler identifier so the task can be audited and reliably removed. 10. Document the persistence lifetime, execution privileges, notification behavior, and data accessed by each scheduled run.