T06 · System Persistence
Warning
- Location
- SKILL.md:24
- Finding
- Mandatory Scheduled Watcher May Persist Beyond the Task Lifecycle## Vulnerability Details **File Location**: `SKILL.md`, line 24 and lines 56–62 **Vulnerability Type**: `T06: System Persistence` **Risk Level**: Medium **Vulnerable instruction snippets**: ```markdown 1. **Kickoff sync** - Post a visible group message with: - task objective - role split (who does what) - expected deliverables - default skills used in this run (Codex + multi-agent-sync when applicable) - Auto-start a temporary watcher job at kickoff (cron/timer) for this task. ``` ```markdown - Prefer a temporary scheduled watcher for active tasks (timer/cron-style). - Watcher tick action: poll agent session history (e.g., topic3/topic5), then immediately publish rollup to topic1. - Completion action: when all agents are done/blocked, publish final closure and remove watcher immediately. - This watcher lifecycle is mandatory whenever this skill is used. - Expected behavior in practice: watcher tick posts rollup to topic1; when both worker topics reach done/blocked, watcher publishes closure and is removed in the same flow. ``` ### Technical Analysis The skill requires every invocation to create a cron job or timer for periodic monitoring. A cron entry or system timer can survive the initiating process and continue running across sessions. Although the instructions require removal after all agents finish, cleanup is defined only for the normal completion path. The skill does not require a maximum lifetime, automatic expiration, failure-safe cleanup handler, ownership marker, idempotent removal procedure, or startup recovery process for orphaned watchers. It also does not restrict implementations to process-local, cancellable timers. Consequently, interruption of the coordinator before normal completion can leave a scheduled task active indefinitely. This is a persistence risk rather than evidence of an intentionally malicious backdoor. The audited files contain no implementation that ...[truncated 1470 chars]
- Remediation
- ## Remediation Suggestions 1. Replace OS-level cron jobs and service timers with an in-process, cancellable timer tied to the coordinator session. 2. Make external scheduler creation optional and require explicit user consent before installing any cross-session task. 3. Assign every watcher a unique task identifier and ownership marker so cleanup targets only the watcher created for the current task. 4. Configure a strict expiration time or execution-count limit at creation so the watcher removes or disables itself even if the coordinator disappears. 5. Register cleanup for success, failure, cancellation, timeout, process termination, and unexpected exceptions. 6. Make cleanup idempotent and verify that the scheduler entry has actually been removed. 7. On coordinator startup, detect and remove expired or orphaned watchers associated with previous runs. 8. Run the watcher with least privilege and restrict it to the minimum session-history and message-posting capabilities required. 9. Document the scheduler type, watcher identifier, expiration time, and cleanup result in the task log for auditability.