T06 · System Persistence
Warning
- Location
- SKILL.md:24
- Finding
- Persistent Daily Agent Execution Through Cron Registration## Vulnerability Details **File Location**: `SKILL.md`, lines 24-38 **Vulnerability Type**: Persistent scheduled task registration **Risk Level**: Medium ### Vulnerable Code ```bash openclaw cron add <<'JSON' { "name": "tuebingen-weather-08", "schedule": { "kind": "cron", "expr": "0 8 * * *", "tz": "Europe/Berlin" }, "sessionTarget": "isolated", "payload": { "kind": "agentTurn", "model": "default", "message": "Run `python3 skills/tuebingen-weather/scripts/fetch_tuebingen_weather.py --output data/weather/$(date +%F)_tuebingen.txt`. Send Master the stdout summary + mention the saved file. Report errors if the command fails." } } JSON ``` ### Technical Analysis The documented setup registers a persistent OpenClaw cron entry that survives the initial skill invocation. At 08:00 each day, the scheduler creates an isolated agent turn and instructs it to execute a Python command, write output to local storage, and forward the resulting summary. Although the scheduled operation is consistent with the weather-reporting purpose and the reviewed Python script contains no malicious payload, installing a recurring agent task establishes cross-session execution. The instructions do not provide an explicit removal command, lifecycle controls, or a confirmation step immediately before persistence is created. The scheduled payload uses a general agent turn rather than a narrowly constrained invocation. Its effective privileges are therefore those available to the scheduled OpenClaw agent and the operating-system account under which it runs. ### Attack Path 1. A user follows the automated-delivery instructions in `SKILL.md`. 2. The user submits the supplied configuration to `openclaw cron add`. 3. OpenClaw creates a persistent task named `tuebingen-weather-08`. 4. At 08:00 each day, the scheduler starts an isolated agent turn. 5. The agent executes `fetch_tuebingen_weather.py`, which make ...[truncated 942 chars]
- Remediation
- ## Remediation Suggestions 1. Make scheduled installation explicitly opt-in and request confirmation immediately before running `openclaw cron add`. 2. Clearly disclose that the task persists across sessions and runs automatically every day. 3. Document exact commands for listing, disabling, and deleting the `tuebingen-weather-08` cron entry. 4. Prefer a narrowly scoped scheduler action that invokes only the fixed script rather than creating a general-purpose agent turn. 5. Run the task under a dedicated least-privilege account with write access limited to the intended weather-output directory. 6. Restrict outbound network access to the required Open-Meteo HTTPS endpoint and the explicitly approved messaging destination. 7. Pin the script path to a trusted, non-user-writable location and verify file ownership and permissions before each execution. 8. Add retention or cleanup controls so daily report files cannot accumulate indefinitely. 9. Record task creation and each scheduled execution in an auditable log, and notify the user when scheduling is enabled or changed.