T06 · System Persistence
Error
- Location
- skill.md:10
- Finding
- Persistent Scheduled Execution of an Unauditable External CLI## Vulnerability Details **File Location**: `skill.md`, lines 10–15 **Vulnerability Type**: Persistent scheduled task invoking external code **Risk Level**: High ```json "cron": [ { "schedule": "*/15 * * * *", "command": "niche check-matches", "description": "Check for new cards matching user watches every 15 minutes" } ] ``` ### Technical Analysis The Skill metadata declares a scheduled task that invokes `niche check-matches` every 15 minutes. This introduces recurring, cross-session execution rather than limiting execution to an explicit user request. The package contains only `skill.md`; it does not include the source code for the invoked `niche` executable. Its network requests, command behavior, authentication handling, and update mechanism therefore cannot be independently audited. This is particularly significant because the documentation states that: - The CLI communicates with a hosted backend. - Authentication state is stored in `~/.niche/auth.json`. - The local authentication file contains an authentication token and wallet information. - `check-matches` is specifically intended to run through cron. The scheduled command is related to the declared watch-notification functionality, but automatic recurring execution exceeds the privilege and lifetime of a one-time marketplace interaction unless the user explicitly opts in. If the external CLI or its hosted backend is compromised, the recurring task provides an ongoing execution opportunity under the user's local context. ### Attack Path 1. The Skill is installed or loaded in an environment that processes its `cron` metadata. 2. A recurring task is registered to execute `niche check-matches` every 15 minutes. 3. The scheduler launches the external `niche` executable without a new user action. 4. The executable may access the documented local session state in `~/.niche/auth.json` and communicate with the hosted backend. 5. If the ...[truncated 996 chars]
- Remediation
- ## Remediation Suggestions 1. Remove automatic cron registration from the default Skill metadata. 2. Require informed, explicit user consent before creating any recurring task. 3. Clearly display the schedule, invoked command, network behavior, and instructions for disabling and removing the task. 4. Include the complete `niche` CLI source code in the reviewed package so its command execution, network destinations, and credential handling can be audited. 5. Pin the CLI and all dependencies to verified versions and integrity hashes. 6. Execute match checks with a narrowly scoped, revocable token that cannot authorize deposits, payments, wallet operations, or unrelated account actions. 7. Prevent the scheduled process from reading broader wallet or authentication material than is necessary to retrieve watch matches. 8. Apply strict timeouts, destination allowlisting, minimal filesystem permissions, and structured logging to scheduled runs. 9. Prefer an explicit command or opt-in notification mechanism over persistent background execution when recurring checks are not essential.