T06 · System Persistence
Error
- Location
- SKILL.md:10
- Finding
- Cross-Session Persistent Background Watcher## Vulnerability Details **File Location**: `SKILL.md:10-19` **Related Locations**: `SKILL.md:62-68`, `SKILL.md:156-194` **Vulnerability Type**: Persistent scheduled or background automation **Risk Level**: High ### Vulnerable Code Snippet ```markdown ## Scope and autonomous actions (read before invoking) Invoking this skill authorizes it to, without pausing for a per-step confirmation: post one top-level GitHub PR comment per completed review cycle, and create or reactivate a background watch that keeps running GitHub reads (and, on a qualifying author response, another review cycle plus another comment) after this invocation ends — potentially across sessions, depending on which host mechanism `../WAITING.md` selects for your runtime. It never pushes code, edits or deletes comments, resolves threads, approves, merges, labels, or closes the PR, and never modifies the PR branch. If you need to know exactly how to list, pause, or permanently stop a watch this skill armed, see the "Arm the Watch" section below and `../WAITING.md`'s host-mapping table before invoking it in an environment where an unattended background job would be unexpected. ``` The persistence mechanisms are further specified as follows: ```markdown on OpenClaw a `cron` job with a `trigger.script` gate, on Codex a heartbeat (inspect active and paused automations by the immutable marker; reuse a same-task match; treat a foreign or ambiguous match as a conflict), on Claude Code a `Monitor` task ID retained for this session. ``` ```markdown Keep it armed while the latest durable marker has `verdict=issues`; stop it when the marker goes `clean`, when the PR leaves `OPEN`, or when the user says to stop. ``` ### Technical Analysis The Skill instructs the agent to create or reactivate unattended host automation that can remain active after the initiating invocation and, on supported hosts, across sessions. The identified mechanisms include cron jobs and durable heartbeat automation. Persis ...[truncated 3514 chars]
- Remediation
- ## Remediation Suggestions 1. Separate immediate PR review from persistent monitoring. Require an explicit, dedicated opt-in immediately before creating any cross-session watcher. 2. Default to session-scoped monitoring that terminates automatically when the current agent session ends. 3. Apply a mandatory expiration time, maximum polling count, and maximum number of follow-up review cycles to every durable watcher. 4. Before creating automation, show the user the exact host mechanism, job identifier, polling condition, expiry, GitHub identity, repository scope, and permitted write operations. 5. Constrain the watcher to the specific repository, PR number, reviewer identity, and immutable workflow identifier. Refuse execution when ownership is foreign or ambiguous. 6. Use the least-privileged GitHub credential possible, limited to the repository and permissions required to read PR data and create issue comments. 7. Provide a verified stop operation within the Skill package rather than relying exclusively on an external file. The stop operation should confirm that the matching cron job, heartbeat, or monitor task was actually removed. 8. Include startup reconciliation and automatic orphan cleanup so stale jobs cannot survive after a clean verdict, closed PR, merged PR, authentication failure, or configured expiry. 9. Record an auditable local status containing the watcher ID, creation time, expiry, repository, PR number, and last successful poll without storing authentication secrets. 10. Bundle and audit the referenced `WAITING.md` implementation so scheduler commands, ownership checks, trigger validation, and cleanup behavior can be independently verified.