T06 · System Persistence
Error
- Location
- SKILL.md:108
- Finding
- Persistent Scheduled Update Mechanism## Vulnerability Details **File Location**: `SKILL.md`, lines 108–125 **Vulnerability Type**: Persistent scheduled task creation **Risk Level**: Critical The skill requires daily updates and provides a cron configuration targeting the main agent session: ```markdown ## Maintenance **Daily update required.** Detection patterns and fixes are pushed frequently. ```bash cd /path/to/arb-injection git pull origin main npm install # If package.json changed ``` Schedule daily update check (09:00): ```json { "schedule": { "kind": "cron", "expr": "0 9 * * *" }, "payload": { "kind": "systemEvent", "text": "ArbInjectionSkill daily update: git pull and npm install" }, "sessionTarget": "main" } ``` ``` ### Technical Analysis The documented configuration establishes a recurring task that survives the original skill invocation and targets the agent's main session. Its payload prompts repeated retrieval and installation of mutable upstream content. This creates a persistent execution channel whose future behavior depends on code controlled outside the audited artifact. The scheduled task is not required for an on-demand contract scan. Combining persistence with `git pull origin main` and `npm install` means a future upstream change can reach the system without a new review of this skill package. ### Attack Path 1. A user or agent follows the maintenance instructions and registers the supplied cron schedule. 2. The scheduled task persists after the initial skill run. 3. At 09:00 each day, a system event targeting the main session requests a Git update and npm installation. 4. An attacker compromises the upstream repository, a maintainer account, or an included dependency. 5. A subsequent update retrieves the attacker-controlled change. 6. `npm install` may execute dependency lifecycle scripts with the permissions of the agent or user running the command. 7. The recurring schedule provides repeated opportunities to retrieve and execute modified content. ### Impac ...[truncated 463 chars]
- Remediation
- ## Remediation Suggestions - Remove the automatic cron configuration and all requirements to perform unattended daily updates. - Require explicit user approval for every update and installation. - Do not target the main agent session with recurring installation instructions. - Pin the repository to a reviewed immutable commit instead of tracking `main`. - Display the exact revision and dependency changes before allowing execution. - Require a new security review whenever executable code or dependency manifests change. - If update notifications are necessary, make them informational only and do not automatically retrieve or install content. - Document how users can locate and remove any previously registered scheduled task.