Compute during Off-Peak Hours for Complex Jobs

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:27 PM UTC
• Version: 1.0.2

Overview

The skill openly describes an overnight cron runner, but the packaged script includes preloaded unrelated tasks that can run later under the user's main agent with access to local context and external accounts.

Do not install this version without carefully inspecting and emptying the packaged script, removing the preloaded tasks, and understanding that the cron job will repeatedly run a broadly privileged main agent. Prefer a version that ships an empty queue, requires per-task approval, avoids the main agent for scheduled work, scopes credentials and file access, and records completed tasks so external actions cannot repeat automatically.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: SKILL.md:52

Finding

Persistent Unattended Execution Through a Daily Cron Job

Content

View full analysis

/dev/null | grep -v "off-peak-compute"; echo "0 2 * * * \$HOME/.openclaw/workspace/scripts/off-peak-compute.sh") | crontab - # Verify crontab -l | grep off-peak ``` ### Technical Analysis The setup instructions register `off-peak-compute.sh` in the user's crontab, causing it to execute automatically at 2 AM every day and persist across interactive sessions and system restarts where cron is available. Scheduling is part of the Skill's stated functionality, so the mere use of cron is not concealed. However, the design grants recurring execution to a mutable script without integrity verification, per-run approval, expiration, task isolation, or a least-privileged execution account. The Skill documentation explicitly states that agent sessions launched by the script receive full user privileges and access to credentials available in the user's environment. The `chmod 700` instruction protects the script from other users but does not protect it from modification by processes already running under the same user account. Any such process—or any task with write access to the script—can alter future unattended executions. The crontab update also removes every existing crontab line containing `off-peak-compute`, rather than matching only the exact entry managed by this Skill. This can unintentionally remove unrelated entries with matching text. ### Attack Path 1. The user follows the installation instructions and copies the packaged script into `~/.openclaw/workspace/scripts/`. 2. The user runs the supplied crontab command. 3. A bundled task, later-added task, or same-user process modifies the scheduled script. ...[truncated 832 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: off-peak-compute.sh:49

Finding

Packaged Script Contains an Active Creator-Specific External Posting Task

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: off-peak-compute.sh:65

Finding

Preloaded Task Directs the Main Agent to Read Persistent Memory and Imitate a Personal Writing Voice

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: off-peak-compute.sh:94

Finding

Completed Tasks Are Replayed Indefinitely Without Idempotency or Retry Limits

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as an off-peak compute optimizer, but the actual mechanism is a generic cron-triggered wrapper that can launch arbitrary agent tasks with full user privileges and access to ambient credentials. This mismatch is dangerous because users may approve it expecting bounded batch compute, while it actually creates a persistent automation channel capable of broader actions such as networked agent operations, file writes, and repeated unattended execution.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 96% confidence

Finding

The YARA match is triggered by behavior commonly used for persistence: modifying crontab to ensure recurring execution. Although this skill openly documents the behavior rather than hiding it, the effect is still a durable autorun mechanism for arbitrary agent-driven tasks, which can be abused as a backdoor-like foothold if a malicious or unsafe task is added.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

at network actions tasks perform

Setup (One-Time)

bash

# Create directories
mkdir -p ~/.openclaw/workspace/scripts
mkdir -p ~/.openclaw/workspace/logs

# Copy the script template (see below)
# Path: ~/.openclaw/workspace/scripts/off-peak-compute.sh

# Make executable (owner only for security)
chmod 700 ~/.openclaw/workspace/scripts/off-peak-compute.sh

# Add cron job (runs at 2 AM daily)
(crontab -l 2>/dev/null | grep -v "off-peak-compute"; echo "0 2 * * * \$HOME/.openclaw/workspace/scripts/off-peak-compute.sh") | crontab -

# Verify
crontab -l | grep off-peak

Script Template

Create ~/.openclaw/workspace/scripts/off-peak-compute.sh:

bash

#!/bin/bash
# off-peak-compute.sh
# 
# OFF-PEAK COMPUTE QUEUE
# Runs automatically at 2 AM via cron
# 
# SECURITY: Tasks run with your user privileges and can access
# your environment's credentials. Each task spawns a new agent
# session (isolated from each other). No sandboxing is provided.
# 
# REVIEW BEFORE ENABLING:
# - Remo

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is presented as an off-peak compute queue for heavy batch/GPU work, but the queued actions perform unrelated autonomous content-generation and external issue-filing tasks. This mismatch is dangerous because users may trust and schedule the skill under one purpose while it silently performs broader agent actions, including internet-facing operations and access to local memory files, expanding the effective permission scope beyond the advertised intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

Setup (One-Time)

bash

# Create directories
mkdir -p ~/.openclaw/workspace/scripts
mkdir -p ~/.openclaw/workspace/logs

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

# Path: ~/.openclaw/workspace/scripts/off-peak-compute.sh

# Make executable (owner only for security)
chmod 700 ~/.openclaw/workspace/scripts/off-peak-compute.sh

# Add cron job (runs at 2 AM daily)
(crontab -l 2>/dev/null | grep -v "off-peak-compute"; echo "0 2 * * * \$HOME/.openclaw/workspace/scripts/off-peak-compute.sh") | crontab -

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

# Path: ~/.openclaw/workspace/scripts/off-peak-compute.sh

# Make executable (owner only for security)
chmod 700 ~/.openclaw/workspace/scripts/off-peak-compute.sh

# Add cron job (runs at 2 AM daily)
(crontab -l 2>/dev/null | grep -v "off-peak-compute"; echo "0 2 * * * \$HOME/.openclaw/workspace/scripts/off-peak-compute.sh") | crontab -

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 99% confidence

Finding

The skill installs a cron entry that persists beyond the current session and automatically executes later with the user's privileges. This is dangerous because any queued or later-modified task will run unattended with access to the user's environment and credentials, creating a durable execution foothold.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

chmod 700 ~/.openclaw/workspace/scripts/off-peak-compute.sh

# Add cron job (runs at 2 AM daily)
(crontab -l 2>/dev/null | grep -v "off-peak-compute"; echo "0 2 * * * \$HOME/.openclaw/workspace/scripts/off-peak-compute.sh") | crontab -

# Verify
crontab -l | grep off-peak

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

(crontab -l 2>/dev/null | grep -v "off-peak-compute"; echo "0 2 * * * $HOME/.openclaw/workspace/scripts/off-peak-compute.sh") | crontab -

Verify

crontab -l | grep off-peak

text

## Script Template

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

Creating a durable script file at a fixed path for later cron execution contributes to persistent unattended behavior, especially because that file can be edited to change future execution without changing cron. In combination with full user privileges and credential access, this creates a reusable execution surface that is more dangerous than an ephemeral one-off task.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

Script Template

Create ~/.openclaw/workspace/scripts/off-peak-compute.sh:

bash

#!/bin/bash

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md

1. What credentials does this task need?
2. What network actions will it perform?
3. Where will it write files?
4. Have I tested it manually?

**Template:**

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

cat ~/.openclaw/workspace/logs/off-peak-compute.log

Check for task output (wherever the task saves results)

ls -la ~/notes/research/

text

## When to Use This

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The comments instruct operators to remove completed tasks before morning, but the implementation leaves tasks in place and explicitly notes they will rerun nightly unless manually removed. This creates a persistence/replay hazard where one-time actions can execute repeatedly, causing duplicate external submissions, repeated writes, or repeated consumption of resources without fresh user approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

A cron-triggered task initiates an autonomous network-facing action to file a GitHub issue, but there is no confirmation or user-visible checkpoint at execution time. In a scheduled unattended context, this is risky because it can publish unintended content, leak workspace-derived information, or repeatedly interact with third-party services if the task remains queued.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.