T06 · System Persistence
- Location
SKILL.md:31- Finding
Automatic Installation of a Persistent Scheduled Task
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 31–35
Vulnerability Type: System Persistence
Risk Level: HighVulnerable Code Snippet
markdown After the user asks Nova to enable oil-price reminders, Nova automatically: 1. Creates the `memory/oil_state.json` state file 2. Creates a cron job, triggered every 3 days 3. Records the next price-adjustment windowThe original Skill text explicitly states that Nova automatically creates a state file and a cron job after the reminder feature is enabled.
Technical Analysis
The Skill instructs the Agent to modify the host's task scheduler by creating a recurring cron job. A cron entry survives the current Skill invocation and causes code to execute automatically in future sessions. This is cross-session system persistence and is therefore classified as
T06: System Persistence.Although recurring execution is related to the advertised reminder function, the instructions do not require explicit confirmation immediately before modifying the scheduler. They also do not specify:
- The exact command and arguments to be installed.
- A unique identifier or ownership marker for the cron entry.
- The account and privilege context under which it will run.
- An expiration or automatic cleanup policy.
- Procedures for listing, disabling, and removing the task.
- Controls preventing duplicate or incorrectly scoped entries.
The monitoring script itself performs recurring HTTPS requests to the declared NDRC website, updates
/workspace/memory/oil_state.json, and prints a reminder. No evidence was found that it retrieves executable code, executes remote content, accesses credentials, or escalates privileges. The risk arises from the Skill's instruction to establish persistent scheduled execution.Attack Path
- A user asks the Agent to enable the oil-price reminder.
- The Agent loads and follows the instructions in
SKILL.md. - The Agent creates the persistent state file under `/wo ...[truncated 1140 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not create cron entries automatically merely because the reminder feature was requested.
- Immediately before scheduler modification, request explicit user approval and display the complete proposed cron expression, executable path, arguments, execution account, and state-file location.
- Prefer a platform-managed reminder or scheduler API that provides ownership, authorization, auditing, lifecycle controls, and automatic cleanup.
- If cron is necessary, install a narrowly scoped entry that:
- Uses an absolute path to the packaged script and interpreter.
- Uses fixed arguments rather than user-controlled shell text.
- Runs with the least-privileged account required.
- Has a unique, recognizable ownership marker.
- Prevents duplicate entries.
- Uses a constrained environment and safe file permissions.
- Add an expiration date or bounded execution count unless the user explicitly requests indefinite monitoring.
- Document and implement commands for listing, disabling, and removing the task.
- Remove both the scheduler entry and associated state data when the user disables or uninstalls the Skill.
- Log creation, execution, modification, and removal of the scheduled task so users can audit persistent activity.