T06 · System Persistence
Warning
- Location
- SKILL.md:48
- Finding
- Persistent Scheduled Agent Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 48–51 **Vulnerability Type**: System Persistence **Risk Level**: Medium **Complete Code Snippet**: ```bash openclaw cron add --name "memory-health-check" \ --cron "0 9 * * *" --tz "Asia/Shanghai" \ --session isolated --agent main \ --message "Run the memory health score, generate a report, and update memory/health-score.json" ``` > The command’s message has been translated into English for reporting. The source uses the equivalent Chinese text. ### Technical Analysis The documented usage command registers a recurring cron task that invokes the main Agent every day at 09:00. The task remains active after the initiating session ends and causes future Agent execution without a new user request, meeting the definition of system persistence. The scheduled operation has a legitimate stated purpose—generating a memory-health report—and no hidden payload, privilege escalation, remote retrieval, or data exfiltration was identified. Nevertheless, using a natural-language message to invoke the main Agent creates a broader and less deterministic execution boundary than directly scheduling the audited local script. Future modifications to the Agent, Skill, workspace content, or message interpretation could therefore affect every subsequent unattended run. ### Attack Path 1. A user follows the usage instructions in `SKILL.md`. 2. `openclaw cron add` registers the `memory-health-check` recurring task. 3. The task persists beyond the current Skill or user session. 4. At 09:00 each day, the scheduler starts an isolated session using the main Agent. 5. The Agent interprets the natural-language message, processes workspace memory data, and updates `memory/health-score.json`. 6. Any later change in the Agent’s behavior, referenced Skill behavior, or relevant workspace instructions may be processed automatically during future scheduled runs. ### Impact Assessmen ...[truncated 619 chars]
- Remediation
- ## Remediation Suggestions 1. Make manual, one-shot execution the default behavior. 2. Require explicit, informed user consent before creating any recurring task. 3. Schedule the audited local command directly, such as `node check-health.mjs`, instead of sending a natural-language instruction to the main Agent. 4. Run the task under a dedicated least-privileged identity restricted to reading the required memory files and writing only `memory/health-score.json`. 5. Document how to inspect, disable, and remove the scheduled task. 6. Provide a clear description of the schedule, execution identity, accessed files, written files, and expected resource usage before installation. 7. Consider expiration, bounded run counts, execution timeouts, and failure-rate limits so the task does not persist indefinitely or repeatedly consume resources after errors. 8. Protect the scheduled command and relevant local script from unauthorized modification.