install-watchdog

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:36 AM UTC
• Version: 1.9.19

Overview

This skill openly installs a persistent watchdog that can relaunch agent sessions, but the long-running authority and missing installer scripts need careful review before use.

Install only if you intentionally want egregore to keep relaunching in the background. Before running it, inspect the actual install_launchd.sh or install_systemd.sh, confirm the service target and schedule, make sure you have a working uninstall path, and be especially cautious with loginctl enable-linger because it can allow execution after logout.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: SKILL.md:20

Finding

Installation of a Persistent Autonomous Watchdog Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–25, 50–66, and 114–117
Vulnerability Type: System persistence through launchd or systemd scheduled services
Risk Level: High

The skill instructs the agent to install an operating-system scheduler that survives the skill invocation and autonomously relaunches egregore sessions every five minutes.

Relevant code:

markdown

Installs a persistent daemon that monitors the egregore
process and relaunches it when needed.
The daemon uses the OS-native scheduler (launchd on macOS,
systemd on Linux) to run a watchdog script every 5 minutes.

markdown

### 2. Run the appropriate installer

**macOS (launchd):**

```bash
bash plugins/egregore/scripts/install_launchd.sh

This script creates a plist at ~/Library/LaunchAgents/com.egregore.watchdog.plist that runs the watchdog script every 300 seconds (5 minutes).

Linux (systemd):

bash

bash plugins/egregore/scripts/install_systemd.sh

This script creates a systemd timer and service unit at ~/.config/systemd/user/ that fires every 5 minutes.

text

```markdown
- **systemd user session not available**: run
  `loginctl enable-linger $USER` to enable user services
  without an active login session.

Technical Analysis

The instructions establish cross-session persistence through either a macOS LaunchAgent or Linux systemd user timer. The resulting scheduler invokes a watchdog every five minutes and may launch new egregore sessions without an interactive request at execution time.

On Linux, the recommendation to run loginctl enable-linger $USER extends this behavior beyond active login sessions. This permits the user-level service manager and its scheduled workload to continue operating after logout.

The installation is disclosed and appears related to the stated watchdog functionality. Nevertheless, it creates durable autonomous execution and therefore meets the definition of system persistence. The actual installer ...[truncated 1720 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not install or activate a persistent scheduler without explicit, informed user approval immediately before installation.
2. Prefer an opt-in, foreground watchdog that terminates with the current session.
3. Require separate confirmation before enabling loginctl lingering, and clearly explain that it permits execution after logout.
4. Display the complete LaunchAgent plist, systemd unit files, timer configuration, and watchdog script before requesting approval.
5. Pin and verify the integrity of all referenced scripts before execution; do not execute scripts that are absent from the reviewed package.
6. Restrict the service to the minimum required user permissions and use a constrained environment, fixed executable paths, and restrictive file permissions.
7. Add execution limits, budget limits, rate controls, and a user-controlled disable switch to prevent uncontrolled relaunch loops.
8. Provide a local uninstall procedure that unloads and removes every installed unit, disables lingering when no longer required, and verifies that no watchdog process remains.
9. Log every launch attempt and expose the service status and next scheduled run to the user.
10. Require renewed authorization before the watchdog launches each agent session if autonomous relaunching is not strictly necessary.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The skill explicitly installs a persistent user-level launchd agent that reruns a watchdog every 5 minutes to relaunch the egregore process. Persistence is a recognized security-sensitive behavior because it enables software to survive normal termination and continue autonomous execution, increasing the blast radius if the monitored process or its update path is compromised.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

bash plugins/egregore/scripts/install_launchd.sh

text

This script creates a plist at
`~/Library/LaunchAgents/com.egregore.watchdog.plist`
that runs the watchdog script every 300 seconds (5 minutes).

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

This line documents creation of a LaunchAgent plist in the user's LaunchAgents directory, which is a standard macOS persistence mechanism. Even though the context is administrative setup rather than covert malware, the behavior still establishes recurring autonomous execution and therefore represents a real persistence capability.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

text

This script creates a plist at
`~/Library/LaunchAgents/com.egregore.watchdog.plist`
that runs the watchdog script every 300 seconds (5 minutes).

**Linux (systemd):**

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md

## Troubleshooting

- **Permission denied on plist**: ensure the script runs
  as the current user, not root.
- **systemd user session not available**: run
  `loginctl enable-linger $USER` to enable user services

Static analysis

No suspicious patterns detected.