T06 · System Persistence
Error
- Location
- SKILL.md:76
- Finding
- Scheduled Cross-Session Execution Through Cron Wake and Session Spawning## Vulnerability Details **File Location**: `SKILL.md`, lines 76–91 **Vulnerability Type**: `T06: System Persistence` **Risk Level**: High **Vulnerable Code:** ```markdown ### Step 4 — Schedule Cron Wake - Register Gateway cron job to wake after appropriate interval (e.g., 2–10 minutes depending on load). - Cron payload MUST contain: - `task_id` - `resume_from=latest_checkpoint` - `reason=timeout_recovery` ### Step 5 — Spawn Resume Session - At wake time, call `sessions_spawn` (or `session_spawn`) with `wakeMode` enabling auto-resume via cron. - Pass concise context: - objective, - latest checkpoint, - next step, - completion criteria. ``` Related persistence instructions also appear at `SKILL.md`, lines 13–15 and 24–26: ```markdown 2. **Cron wake** to re-invoke agent at scheduled time. 3. **Resume task** from latest checkpoint using `sessions_spawn` (or `session_spawn` depending on runtime) with appropriate `wakeMode`. ``` ```markdown - `sessions_spawn` / `session_spawn` (spawn new work session) - Gateway cron jobs (schedule wake events) - Memory/slot for state persistence (state checkpoint) ``` ### Technical Analysis The Skill directs an Agent to persist task state, create a Gateway cron job, and use the scheduled event to spawn a new session that resumes execution from the stored checkpoint. This establishes an execution chain that survives the original Agent session and can continue without contemporaneous user interaction. Although the document requires retry limits and cancellation after completion, these are procedural instructions rather than demonstrated platform-enforced controls. The scheduled task and persisted resume context therefore constitute a cross-session persistence mechanism under `T06: System Persistence`. If an unsafe, compromised, or overly privileged task activates this mechanism, its actions can be resumed repeatedly after the initiating session has en ...[truncated 1779 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit, informed user approval before creating each cron job and before spawning every resumed session. 2. Enforce authorization in the Gateway rather than relying solely on Skill instructions. Bind each scheduled wake to the authenticated user, originating task, and narrowly scoped permissions. 3. Give every cron job a short, mandatory expiration time, a platform-enforced maximum retry count, and a non-renewable execution deadline. 4. Validate checkpoint integrity and provenance using authenticated metadata or signatures before using it to resume execution. 5. Treat checkpoint contents as untrusted data. Do not interpret stored objectives, errors, artifacts, or next actions as higher-priority instructions. 6. Store only the minimum resume state required and prohibit credentials, access tokens, secrets, or unnecessary sensitive data in checkpoints. 7. Restrict resumed sessions to the least privileges required for the specific task. Do not automatically inherit broader permissions from the originating session. 8. Display pending wake jobs, their owners, execution times, and intended actions to the user, and provide an immediate cancellation mechanism. 9. Guarantee cleanup on completion, failure, cancellation, malformed checkpoints, authorization failure, and retry exhaustion. 10. Record immutable audit events for checkpoint creation, cron registration, wake execution, session spawning, authorization decisions, and cleanup. 11. Prefer a platform-managed resumable job facility that cannot alter its objective or permissions over general-purpose cron-triggered Agent spawning.