T06 · System Persistence
Error
- Location
install.sh:202- Finding
Installers Establish Persistent Scheduled Execution Through User Crontab
- Content
View full analysis
/dev/null | grep -q "agent-memory-system"; then log_info "cron tasks already exist; skipping" else ( crontab -l 2>/dev/null || true echo "# agent-memory-system" echo "0 0 * * 0 $GC_SCRIPT >> $LOG_DIR/memory-gc.log 2>&1" echo "# agent-memory-system" echo "45 23 * * * $REFLECTION_SCRIPT >> $LOG_DIR/nightly-reflection.log 2>&1" ) | crontab - fi ``` The security-relevant commands in `scripts/install.sh:50-62` are: ```bash if crontab -l 2>/dev/null | grep -q "memory-gc.sh"; then echo "Existing memory-gc.sh configuration detected; skipping" else (crontab -l 2>/dev/null | grep -v "memory-gc.sh" || true; echo "0 0 * * 0 $SCRIPT_DIR/memory-gc.sh") | crontab - fi if crontab -l 2>/dev/null | grep -q "nightly-reflection.sh"; then echo "Existing nightly-reflection.sh configuration detected; skipping" else (crontab -l 2>/dev/null | grep -v "nightly-reflection.sh" || true; echo "45 23 * * * $SCRIPT_DIR/nightly-reflection.sh") | crontab - fi ``` ### Technical Analysis Both installers modify the current user's crontab and establish recurring execution of scripts stored in the Skill directory. The weekly task runs `memory-gc.sh`, while the daily task runs `nightly-reflection.sh`. The scheduled behavior supports the advertised automatic archival and nightly-reflection features and is documented in `README.md` and `SKILL.md`. It is therefore not covert or unrelated to the declared functionality. Nevertheless, it creates execution persistence that survives the installer and future agent sessions. The top-level `install.sh` performs the modification automatically, without explicit confirmation. The secondary installer asks for consent, but defaults t ...[truncated 1608 chars]- Remediation
View remediation