T06 · System Persistence
Error
- Location
- SKILL.md:351
- Finding
- Persistent Autonomous Execution Through Scheduled Agent Jobs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:351-390`; related concrete cron configuration in `SKILL-v2.3-backup.md:376-384` **Vulnerability Type**: Autonomous scheduled execution and cross-session persistence **Risk Level**: Critical ### Vulnerable Code ```markdown ## Autonomous vs Prompted Crons ⭐ NEW **Key insight:** There's a critical difference between cron jobs that *prompt* you vs ones that *do the work*. ### Two Architectures | Type | How It Works | Use When | |------|--------------|----------| | `systemEvent` | Sends prompt to main session | Agent attention is available, interactive tasks | | `isolated agentTurn` | Spawns sub-agent that executes autonomously | Background work, maintenance, checks | ### The Failure Mode You create a cron that says "Check if X needs updating" as a `systemEvent`. It fires every 10 minutes. But: - Main session is busy with something else - Agent doesn't actually do the check - The prompt just sits there **The Fix:** Use `isolated agentTurn` for anything that should happen *without* requiring main session attention. ### Example: Memory Freshener **Wrong (systemEvent):** ```json { "sessionTarget": "main", "payload": { "kind": "systemEvent", "text": "Check if SESSION-STATE.md is current..." } } ``` **Right (isolated agentTurn):** ```json { "sessionTarget": "isolated", "payload": { "kind": "agentTurn", "message": "AUTONOMOUS: Read SESSION-STATE.md, compare to recent session history, update if stale..." } } ``` ``` The packaged backup also contains a directly usable scheduled-job definition: ```text cron action=add job={ "name": "reverse-prompting-weekly", "sessionTarget": "main", "schedule": {"kind": "cron", "expr": "0 14 * * 0", "tz": "America/Los_Angeles"}, "payload": {"kind": "systemEvent", "text": "REVERSE PROMPTING TIME: Ask your human what interesting things you could do that they haven't thought of, and what information would help you be more useful."} } ...[truncated 1769 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the concrete cron installation command from the packaged backup. 2. Remove recommendations to create autonomous `isolated agentTurn` jobs by default. 3. Require explicit, informed user approval before creating every scheduled task. 4. Present the complete schedule, payload, accessible resources, and expected side effects before approval. 5. Restrict scheduled jobs to narrowly scoped, read-only operations wherever possible. 6. Do not permit scheduled agents to modify memory or instruction-bearing files automatically. 7. Provide commands for listing, disabling, and permanently deleting every installed job. 8. Apply expiration dates and execution-count limits to approved jobs. 9. Record an audit event for job creation, modification, execution, and deletion. 10. Require renewed approval whenever a job payload or referenced instruction file changes. ]]>