T06 · System Persistence
Error
- Location
- SKILL.md:205
- Finding
- Unattended Pipeline Resumption Through a Persistent Scheduled Task<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:205-208` **Vulnerability Type**: Persistent scheduled execution **Risk Level**: High ### Vulnerable Code ```text To mitigate, set a cron safety net after spawning: cron: "Check book pipeline state in WORKLOG.md. If last phase completed but next phase not started, resume the pipeline." (fire 15 minutes after spawn) ``` ### Technical Analysis The skill instructs the agent to create a cron-based safety net that resumes the book pipeline after the initiating interaction. A scheduled task operates outside the immediate skill execution and may continue to affect later sessions. The instruction does not specify: - Explicit user authorization before installing the task. - A unique identifier tied to the current project. - Automatic removal after completion, cancellation, or failure. - A maximum number of executions. - Validation that the project and its authorization state remain unchanged. - A requirement to reconfirm potentially costly or externally visible actions. Because the resumed pipeline can spawn agents, consume paid API services, modify files, and eventually publish content, this persistence mechanism crosses the normal lifetime boundary of a skill invocation. ### Attack Path 1. The skill is activated for a book-generation project. 2. Nested subagents are unavailable, causing the workflow to use Director-controlled fallback mode. 3. The skill creates the recommended cron safety-net task. 4. The current session stops, is interrupted, or the user assumes the workflow has been paused. 5. Fifteen minutes later, the scheduled task reads the project-controlled `WORKLOG.md`. 6. If the log appears to indicate that another phase should start, the task resumes the pipeline without renewed user approval. 7. The resumed workflow may spawn agents, invoke paid APIs, modify repository content, and reach its commit-and-push phase. A modified, stale, or incorrectly interpreted `WORKLOG.md` could cause e ...[truncated 583 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to create an operating-system or platform-level cron task. 2. Use an application-scoped, one-shot continuation mechanism that cannot survive project cancellation. 3. Require explicit user consent before scheduling any delayed execution. 4. Assign each continuation job a unique project identifier and verify the repository path, owner, and workflow state before resuming. 5. Automatically delete the job after its first execution, successful completion, cancellation, or expiration. 6. Add a short expiration time and a strict maximum execution count. 7. Require renewed approval before agent spawning, paid API calls, commits, pushes, or other externally visible operations. 8. Treat `WORKLOG.md` as untrusted state: validate its schema and never use arbitrary text from it as executable instructions. ]]>