T06 · System Persistence
Warning
- Location
- SKILL.md:75
- Finding
- Persistent Weekly Agent Execution Through Cron Scheduling## Vulnerability Details **File Location**: `SKILL.md`, lines 75–84 **Vulnerability Type**: Persistent scheduled agent execution **Risk Level**: Medium ### Vulnerable Code ```markdown ## Cron Job Setup **Recommended schedule:** Weekly, Wednesday UTC 13:00 (Stockholm 14:00) ``` schedule: { "kind": "cron", "expr": "0 13 * * 3", "tz": "UTC" } sessionTarget: "isolated" payload.kind: "agentTurn" timeoutSeconds: 0 ``` ``` ### Technical Analysis The skill recommends creating a recurring cron job whose payload is an autonomous `agentTurn`. Once installed, this scheduled task survives the initial skill invocation and executes every Wednesday without requiring a new direct user request. The configured `timeoutSeconds: 0` may permit the scheduled agent turn to run without an explicit time limit. The referenced cron prompt directs subsequent runs to read and modify workspace files, open an authenticated browser profile, and send Telegram messages. Consequently, accepting the setup extends the skill's operational lifetime and authority beyond the session in which it was configured. This is a persistence mechanism rather than evidence of a concealed startup backdoor. The scheduling behavior is documented and supports the skill's stated automation purpose, but it still crosses a session boundary and should require explicit, informed authorization. Risk increases if the prompt, topic queue, referenced files, browser profile, or notification destination can later be modified by an untrusted party. ### Attack Path 1. A user or privileged agent loads the skill and follows its cron setup recommendation. 2. A recurring scheduled task is registered with an `agentTurn` payload. 3. The initial session ends, but the scheduled task remains installed. 4. On each weekly trigger, the agent reads the topic queue and related content from the configured workspace. 5. If an attacker can alter those inputs or the stored cron prompt, attac ...[truncated 1033 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user confirmation immediately before registering any scheduled task, including a clear description of its frequency, permissions, integrations, and removal procedure. 2. Do not create the cron job automatically when the skill is loaded or invoked for ordinary draft generation. 3. Apply a finite execution timeout instead of `timeoutSeconds: 0`, with a limit appropriate for one article-generation run. 4. Run the scheduled task with a dedicated least-privilege identity restricted to the required Substack workspace directory. 5. Disable shell execution, unrestricted filesystem access, credential access, and unrelated network tools for scheduled sessions. 6. Restrict browser automation to the intended Substack origin and retain the existing requirement for human approval before publication. 7. Validate the topic queue and other workspace inputs as untrusted data; do not interpret content from those files as agent instructions. 8. Pin the scheduled prompt or verify its integrity before each run so that unauthorized modifications cannot silently change future behavior. 9. Provide commands or documented controls to list, pause, and permanently remove the cron job. 10. Record each scheduled execution and notify the user when the job is created, changed, triggered, disabled, or deleted. 11. Consider an approval-gated scheduler that requests confirmation before every run rather than permitting unattended recurring execution.