T06 · System Persistence
Error
- Location
- SKILL.md:37
- Finding
- Persistent autonomous execution with permission safeguards disabled<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:37-56`; related guidance in `references/lessons-learned.md:40-42` **Vulnerability Type**: Persistent scheduled execution and excessive agent privileges **Risk Level**: Critical ### Vulnerable Code ```bash ### 2. Verify Claude Code /path/to/claude --version /path/to/claude -p --dangerously-skip-permissions --output-format text "echo hello" ``` ```bash ### 3. Create the Cron Job openclaw cron add \ --name "email-check" \ --every 15m \ --session isolated \ --announce \ --to <YOUR-TELEGRAM-CHAT-ID> \ # explicit ID, NOT --channel last --timeout-seconds 120 \ --description "Check email + GitHub for ticket assignments" \ --message "$(cat /path/to/cron-prompt.txt)" ``` Related production guidance: ```text Spawn a subagent (`runtime: "subagent"`) that runs `claude -p --dangerously-skip-permissions --output-format text "..."` via exec instead of using ACP directly. ``` ### Technical Analysis The Skill creates a scheduled job that continues to execute every 15 minutes across sessions. Scheduled execution is part of the declared overnight automation, but it materially increases security exposure because the job continually consumes externally controlled email and GitHub data. The guidance also explicitly runs Claude Code with `--dangerously-skip-permissions`. Although the first command is presented as a verification step, `references/lessons-learned.md` recommends using the same option for operational subagents. This removes interactive permission boundaries from agents that can inspect repositories, execute tools, modify files, create commits, push branches, post comments, and open pull requests. Combining persistent scheduling with disabled permission checks means that one malicious ticket, compromised mailbox, compromised GitHub account, or prompt-injection payload can repeatedly reach a privileged execution environment without a human approval checkpoint. ### Attack Path 1. A ...[truncated 1577 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `--dangerously-skip-permissions` from both verification and production commands. 2. Run each ticket in a fresh, disposable container or virtual machine with: - A read-only base filesystem. - A dedicated writable checkout. - No access to the parent workspace or unrelated repositories. - Restricted outbound network access. - CPU, memory, process, and execution-time limits. 3. Use an explicit allowlist for executable commands, repositories, organizations, file paths, and network destinations. 4. Separate analysis from mutation: - First run a read-only analysis agent. - Present the proposed patch and actions to a human. - Require approval before running commands, changing files, pushing commits, commenting, or opening a PR. 5. Use a narrowly scoped GitHub App installation token issued per job rather than a persistent personal access token. 6. Add a documented disable and removal procedure for the cron job. 7. Prevent overlapping cron executions and enforce a strict maximum number of subagents per run. 8. Record security-relevant actions without logging credentials, mailbox contents, or other sensitive data. ]]>