T06 · System Persistence
Error
- Location
SKILL.md:65- Finding
Optional Cron Configuration Creates Persistent Hourly Execution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:65-72
Vulnerability Type:T06: System Persistence
Risk Level: HighComplete Code Snippet:
markdown ## Cron Setup Run hourly for consistent alpha: ```bash # Add to crontab 0 * * * * python3 /path/to/scripts/scanner.py >> /var/log/alpha.logtext ### Technical Analysis The documentation instructs the user to create a cron entry that executes the scanner every hour. Although the Skill does not install this entry automatically and the behavior is openly documented, following the instruction establishes execution that persists across sessions and system restarts. Periodic execution is relevant to continuous market monitoring, but it is not required for the scanner's basic one-command functionality. It therefore exceeds the minimum privileges and lifecycle necessary for an ordinary invocation. The command also appends indefinitely to `/var/log/alpha.log`, which may require elevated permissions depending on the system and provides no rotation or storage limit. The cron entry references a mutable script path. If that file is subsequently replaced or modified by another process or account with write access, the altered code will execute automatically under the privileges of the account that owns the cron entry. ### Attack Path 1. A user follows the documented cron setup instructions. 2. The user adds the entry to their crontab, potentially using elevated privileges to permit writes under `/var/log`. 3. The scanner begins making outbound API requests and appending output every hour without further interaction. 4. An attacker or compromised process with write access to `scripts/scanner.py` modifies or replaces the script. 5. Cron executes the modified script automatically with the privileges of the cron owner. 6. Alternatively, continuous append operations cause uncontrolled growth of `/var/log/alpha.log`, potentially consuming available disk sp ...[truncated 628 chars]- Remediation
View remediation
Remediation Suggestions
- Clearly label scheduling as optional and separate it from the default quick-start workflow.
- Do not recommend elevated installation or a root-owned cron entry.
- Store output in a user-owned application data directory rather than
/var/log. - Configure log rotation, retention limits, or overwrite behavior to prevent unlimited growth.
- Execute the scanner from a trusted, owner-writable-only directory and ensure the script and parent directories are not writable by less-privileged accounts.
- Use an absolute Python interpreter path and a minimal environment.
- Consider a sandboxed user-level systemd timer with filesystem, network, and privilege restrictions.
- Document how to inspect and remove the scheduled task.
- If persistent monitoring is unnecessary, recommend explicit one-shot execution instead.