T06 · System Persistence
Error
- Location
- skill.md:231
- Finding
- Recurring Cron Job Creates Cross-Session Persistence## Vulnerability Details **File Location**: `skill.md`, lines 231–234 **Vulnerability Type**: Scheduled-task persistence **Risk Level**: High ```bash # 定时任务分析每日会议 crontab -e 0 18 * * * /path/to/openclaw-talk batch --config daily-config.json ``` ### Technical Analysis The documentation instructs the user to modify their crontab and register `openclaw-talk` for unattended daily execution. The cron entry survives the current terminal and agent session, making it a system-persistence mechanism. Scheduling can support the optional batch-analysis workflow, but it is not required for the Skill's core conversation-analysis functionality. It therefore exceeds the minimum privileges and execution lifetime necessary for ordinary use. The instructions do not provide safeguards such as a dedicated least-privilege account, protected absolute paths, configuration integrity checks, restricted file permissions, execution logging, or an uninstall procedure. The command and configuration paths become persistent trust points. If either the executable or `daily-config.json` can later be replaced or modified, the cron daemon will execute the altered behavior automatically with the privileges of the account that owns the crontab. ### Attack Path 1. A user follows the documentation and adds the recurring cron entry. 2. The scheduled command remains active after the original Skill invocation ends. 3. An attacker or compromised dependency replaces or modifies `/path/to/openclaw-talk`, one of its dependencies, or `daily-config.json`. 4. At 18:00, cron invokes the compromised executable or configuration without requiring fresh user approval. 5. The payload runs with the privileges and file access of the crontab owner. 6. Files available to that account, including conversation records, reports, environment files, and API credentials, may be read, modified, deleted, or transmitted. ### Impact Assessment Successful exploitation permits recurring, unattended execution under the affe ...[truncated 468 chars]
- Remediation
- ## Remediation Suggestions - Remove the cron-registration example from the default Skill workflow. - Keep scheduling explicitly optional and require informed user approval before creating a persistent task. - Prefer a user-visible scheduler or manually invoked batch command for the standard workflow. - Run scheduled analysis through a dedicated, non-privileged service account with access only to the required input and output directories. - Use canonical absolute paths for the executable and configuration file. - Make the executable and configuration files non-writable by accounts that do not administer the scheduled task. - Pin and verify the executable and dependencies before every deployment. - Restrict access to conversation files, reports, `.env` files, and API credentials. - Add audit logging, failure notifications, rate limits, and outbound-network controls. - Document how to inspect and remove the entry, such as using `crontab -l` and `crontab -e`. - Warn users not to install the task in root's crontab.