From 0c1e6b5279071dfad165709753111d85516d94b3 Mon Sep 17 00:00:00 2001 From: jp39 Date: Tue, 16 Jun 2026 17:02:25 +0200 Subject: [PATCH] docs: warn about cron remote wildcard Document that command_allowed_remotes = ["*"] is potentially dangerous because any remote channel that can talk to PicoClaw can schedule shell commands. Clarify that it should only be used when all enabled remote channels and chats are trusted. --- docs/guides/configuration.md | 2 +- docs/reference/cron.md | 4 ++++ docs/reference/tools_configuration.md | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/docs/guides/configuration.md b/docs/guides/configuration.md index c030206c8..8ac866880 100644 --- a/docs/guides/configuration.md +++ b/docs/guides/configuration.md @@ -1164,7 +1164,7 @@ PicoClaw supports cron-style scheduled tasks via the `cron` tool. The agent can Scheduled tasks persist across restarts and are stored in `~/.picoclaw/workspace/cron/`. -Command cron jobs can execute shell commands. By default, remote channels cannot schedule command jobs. To allow specific remote channels, set `command_allowed_remotes` to entries such as `"telegram"` or `"telegram:1234567890"`; use `"*"` only if every non-empty channel should be allowed. This does not bypass `allow_command`, `command_confirm`, or exec safety checks. +Command cron jobs can execute shell commands. By default, remote channels cannot schedule command jobs. To allow specific remote channels, set `command_allowed_remotes` to entries such as `"telegram"` or `"telegram:1234567890"`; use `"*"` only if every non-empty channel should be allowed. The `"*"` wildcard is potentially dangerous because any remote channel that can talk to PicoClaw can schedule shell commands. This does not bypass `allow_command`, `command_confirm`, or exec safety checks. ### Advanced Topics diff --git a/docs/reference/cron.md b/docs/reference/cron.md index 1ac36a52a..e421b37e3 100644 --- a/docs/reference/cron.md +++ b/docs/reference/cron.md @@ -125,6 +125,10 @@ Entries can be either a channel name or a channel plus chat id: - `telegram:1234567890` allows command jobs only from that exact Telegram chat id. - `*` allows command jobs from every non-empty channel. +Warning: `*` is potentially dangerous because any remote channel that can talk +to PicoClaw can schedule shell commands. Use it only when every enabled remote +channel and chat is trusted to request command execution. + This setting only controls the remote-channel gate. It does not bypass `tools.cron.allow_command`, `command_confirm`, `tools.exec.enabled`, or the exec tool's command safety checks. Example: diff --git a/docs/reference/tools_configuration.md b/docs/reference/tools_configuration.md index 1be05b086..c3a9140b5 100644 --- a/docs/reference/tools_configuration.md +++ b/docs/reference/tools_configuration.md @@ -315,7 +315,7 @@ The cron tool is used for scheduling periodic tasks. |---------------------------|----------|---------|----------------------------------------------------------------| | `enabled` | bool | true | Register the agent-facing cron tool | | `allow_command` | bool | true | Allow command jobs without extra confirmation | -| `command_allowed_remotes` | string[] | [] | Remote channels or `channel:chat_id` values allowed for command jobs; `*` allows every channel | +| `command_allowed_remotes` | string[] | [] | Remote channels or `channel:chat_id` values allowed for command jobs; `*` allows every channel and is dangerous unless all remote channels are trusted | | `exec_timeout_minutes` | int | 5 | Execution timeout in minutes, 0 means no limit | For schedule types, execution modes (`deliver`, agent turn, and command jobs), persistence, and the current command-security gates, see [Scheduled Tasks and Cron Jobs](cron.md).