T06 · System Persistence
Error
- Location
- readme.md:97
- Finding
- Reboot-Persistent Execution Through Scheduled Tasks<![CDATA[ ## Vulnerability Details **File Location**: `readme.md:97` **Vulnerability Type**: `T06: System Persistence` **Risk Level**: High ### Vulnerable Documentation Snippet ```markdown 3. **Automation**: Run the orchestrator as a **Background Task** (`schtasks`) to ensure persistence across reboots. ``` Related scheduling guidance also appears in `skill.md:108`: ```markdown - **Scheduling Reliability**: Use **Headless Discrete Execution** (Windows Task Scheduler / Cron). Avoid infinite `while($true)` loops to prevent memory leaks and handle system reboots gracefully. ``` ### Technical Analysis The Skill explicitly recommends registering the generated orchestrator with Windows Task Scheduler or cron so that it continues executing after reboot. This creates a cross-session persistence mechanism and an enduring system configuration change. Persistent scheduling is operationally relevant to a continuously running notifier, but it exceeds the privileges required for an on-demand or session-scoped notification task. The documentation does not require explicit user confirmation, prescribe a least-privilege service account, constrain the task definition, or provide removal and verification procedures. No bundled executable implementation was present, so the audit did not confirm hidden task creation, privilege escalation, or an attacker-controlled command. The risk arises from instructions that direct an Agent or user to establish persistent execution. ### Attack Path 1. A user or Agent loads the Skill and implements the described notification orchestrator. 2. The deployment process creates a Windows scheduled task using `schtasks`, or an equivalent cron entry. 3. The task is configured to invoke the orchestrator automatically at a fixed interval or system startup. 4. The task survives logout and reboot and continues running under the configured account. 5. If the orchestrator, its configuration, or its executable path is later modified, the scheduled tas ...[truncated 690 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Make persistent scheduling explicitly optional and require informed user confirmation before creating a task. - Default to foreground or manually invoked execution. - Run the task under a dedicated, non-administrative account with only the filesystem and network permissions needed by the notifier. - Use an absolute executable path and restrict write access to the orchestrator, configuration, and working directories. - Do not store credentials in task arguments, command lines, or task descriptions. - Document the exact task name, trigger, executable, working directory, account, and network destinations. - Provide commands to inspect, disable, and completely remove the scheduled task or cron entry. - Record task creation and configuration changes in an audit log. - Validate ownership and permissions before every scheduled execution. ]]>