T06 · System Persistence
Error
- Location
- SKILL-v2.3-backup.md:376
- Finding
- Persistent Weekly Cron Job Influences Future Agent Sessions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL-v2.3-backup.md:376-389` **Vulnerability Type**: Cross-session scheduled agent persistence **Risk Level**: Critical ### Vulnerable Code ```text **2. Schedule it:** Add a weekly cron job that fires a reminder: ``` cron action=add job={ "name": "reverse-prompting-weekly", "sessionTarget": "main", "schedule": {"kind": "cron", "expr": "0 14 * * 0", "tz": "America/Los_Angeles"}, "payload": {"kind": "systemEvent", "text": "REVERSE PROMPTING TIME: Ask your human what interesting things you could do that they haven't thought of, and what information would help you be more useful."} } ``` ``` ### Technical Analysis The Skill explicitly instructs the agent to install a recurring cron job targeting the main session. The resulting job survives the current Skill invocation and injects behavioral prompts into future sessions without a new user request. Although the scheduled payload shown is not destructive, establishing persistent scheduled execution is unnecessary for the core task of providing proactive-agent templates. It creates a durable mechanism whose payload or behavior may later be altered and whose repeated prompts can influence unrelated future sessions. ### Attack Path 1. A user installs or loads the Skill. 2. The agent interprets the cron example as an implementation instruction. 3. The agent invokes the cron tool and creates `reverse-prompting-weekly`. 4. The scheduled job persists after the original conversation ends. 5. Every week, the framework sends the stored `systemEvent` to the main agent session. 6. Future sessions are influenced without contemporaneous, task-specific user authorization. ### Impact Assessment The Skill obtains a persistent behavioral execution channel into future main sessions. The scope includes recurring unsolicited prompts, continued behavioral influence, consumption of agent resources, and potential access to whatever tools and context are available when ...[truncated 29 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove all instructions that directly create cron jobs. - Present scheduling only as an optional capability that requires explicit, informed user approval. - Show the complete schedule, target session, payload, permissions, and expected lifetime before creation. - Default scheduled tasks to disabled and read-only. - Require an expiration time or maximum execution count. - Provide commands for listing, disabling, and deleting every created job. - Never target the main session with persistent prompts unless the user explicitly requests that exact behavior. - Record user approval and verify the installed job matches the approved configuration. ]]>