T06 · System Persistence
Error
- Location
- SKILL.md:31
- Finding
- Automatic Installation of a Persistent Scheduled Task## Vulnerability Details **File Location**: `SKILL.md`, lines 31–35 **Vulnerability Type**: System Persistence **Risk Level**: High ### Vulnerable Code Snippet ```markdown After the user asks Nova to enable oil-price reminders, Nova automatically: 1. Creates the `memory/oil_state.json` state file 2. Creates a cron job, triggered every 3 days 3. Records the next price-adjustment window ``` The original Skill text explicitly states that Nova automatically creates a state file and a cron job after the reminder feature is enabled. ### Technical Analysis The Skill instructs the Agent to modify the host's task scheduler by creating a recurring cron job. A cron entry survives the current Skill invocation and causes code to execute automatically in future sessions. This is cross-session system persistence and is therefore classified as `T06: System Persistence`. Although recurring execution is related to the advertised reminder function, the instructions do not require explicit confirmation immediately before modifying the scheduler. They also do not specify: - The exact command and arguments to be installed. - A unique identifier or ownership marker for the cron entry. - The account and privilege context under which it will run. - An expiration or automatic cleanup policy. - Procedures for listing, disabling, and removing the task. - Controls preventing duplicate or incorrectly scoped entries. The monitoring script itself performs recurring HTTPS requests to the declared NDRC website, updates `/workspace/memory/oil_state.json`, and prints a reminder. No evidence was found that it retrieves executable code, executes remote content, accesses credentials, or escalates privileges. The risk arises from the Skill's instruction to establish persistent scheduled execution. ### Attack Path 1. A user asks the Agent to enable the oil-price reminder. 2. The Agent loads and follows the instructions in `SKILL.md`. 3. The Agent creates the persistent state file under `/wo ...[truncated 1140 chars]
- Remediation
- ## Remediation Suggestions 1. Do not create cron entries automatically merely because the reminder feature was requested. 2. Immediately before scheduler modification, request explicit user approval and display the complete proposed cron expression, executable path, arguments, execution account, and state-file location. 3. Prefer a platform-managed reminder or scheduler API that provides ownership, authorization, auditing, lifecycle controls, and automatic cleanup. 4. If cron is necessary, install a narrowly scoped entry that: - Uses an absolute path to the packaged script and interpreter. - Uses fixed arguments rather than user-controlled shell text. - Runs with the least-privileged account required. - Has a unique, recognizable ownership marker. - Prevents duplicate entries. - Uses a constrained environment and safe file permissions. 5. Add an expiration date or bounded execution count unless the user explicitly requests indefinite monitoring. 6. Document and implement commands for listing, disabling, and removing the task. 7. Remove both the scheduler entry and associated state data when the user disables or uninstalls the Skill. 8. Log creation, execution, modification, and removal of the scheduled task so users can audit persistent activity.