T06 · System Persistence
Warning
- Location
SKILL.md:32- Finding
Persistent Scheduled Execution Through Remote Triggers, OpenClaw, or System Crontab
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 32–52
Vulnerability Type: Persistent scheduled-task creation
Risk Level: MediumVulnerable Code
markdown **Claude Code — Session-scoped (CronCreate):** If the user says something like "set up a daily digest at 8am" or "push it to me every morning", and they're running in Claude Code: Use the `CronCreate` tool with: - `cron`: an appropriate expression that avoids the :00 mark (e.g., `"3 8 * * *"` for ~8am daily, nudge a few minutes off the round hour to avoid API pile-ups) - `prompt`: `"Run the agentic-commerce-news skill: scan the past 7 days of agentic commerce activity and generate the weekly briefing."` - `recurring`: `true` Tell the user: - Scheduled jobs live in the current Claude session memory (not persisted to disk by default — pass `durable: true` if they want it to survive restarts) - Recurring tasks auto-expire after 7 days of this session - Jobs only fire while the REPL is idle **Claude Code — Persistent (remote triggers):** If the user wants a schedule that runs even when their laptop is closed, suggest they use the `/schedule` skill to create a remote trigger (managed by claude.ai). This runs on Anthropic's infrastructure, not locally. **OpenClaw:** If the environment has `openclaw` CLI available (check with `which openclaw`), use `openclaw cron add` instead. OpenClaw jobs run 24/7 as a persistent agent. **Other runtimes:** If none of the above is available, fall back to system `crontab` with a script that invokes the CLI (advanced).Technical Analysis
The Skill instructs the agent to establish recurring execution using durable Claude tasks, remote triggers, OpenClaw cron jobs, or an operating-system
crontabentry. These mechanisms can survive the initiating interaction and repeatedly launch an agent or CLI with network access.Scheduling is related to the declared digest functionality and is conditioned on a user request, which reduces the likelihood ...[truncated 2430 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the system
crontabfallback and avoid generating local wrapper scripts. - Restrict scheduling to a platform-managed scheduler that provides task visibility, revocation, audit logs, and expiration controls.
- Require explicit confirmation immediately before creating any persistent task, including the exact schedule, execution environment, command or prompt, destination, expiration date, and expected network activity.
- Default all recurring tasks to a short expiration period. Require separate confirmation for durable or indefinite execution.
- Provide the task identifier and exact cancellation instructions after creation.
- Run scheduled jobs under a dedicated least-privilege identity with a restricted environment, fixed executable paths, and only the network permissions required for public news retrieval.
- Pin the invoked Skill or prompt version so that later changes are not automatically executed by an existing schedule without review.
- Add scheduling tools to
allowed-toolsonly if persistent scheduling is intentionally supported and enforceable by the runtime. Otherwise, retainWebSearchandWebFetchonly and limit the Skill to on-demand execution. - Clearly disclose recurring API usage, network requests, resource consumption, and whether the task survives restarts before obtaining consent.
- Remove the system