T06 · System Persistence
Error
- Location
- SKILL.md:109
- Finding
- Persistent Scheduled Update and Installation Task## Vulnerability Details **File Location**: `SKILL.md:109-125` **Vulnerability Type**: Persistent scheduled execution **Risk Level**: High ### Vulnerable Code ```markdown ## Maintenance **Daily update required.** Detection patterns and fixes are pushed frequently. ```bash cd /path/to/arb-injection git pull origin main npm install # If package.json changed ``` Schedule daily update check (09:00): ```json { "schedule": { "kind": "cron", "expr": "0 9 * * *" }, "payload": { "kind": "systemEvent", "text": "ArbInjectionSkill daily update: git pull and npm install" }, "sessionTarget": "main" } ``` ``` ### Technical Analysis The skill requires a recurring cron-like task directed at the main session. The task persists beyond the original skill invocation and repeatedly requests retrieval and installation of code from a mutable remote branch. Although the scheduled payload is expressed as a system event rather than a directly embedded shell command, its explicit purpose is to trigger `git pull` and `npm install`. If the agent follows the event automatically or with insufficient review, new upstream code and package lifecycle scripts can execute in later sessions without being covered by the original audit. ### Attack Path 1. A user loads the skill and follows its maintenance instructions. 2. The daily schedule is registered against the main agent session. 3. An upstream maintainer, compromised account, or repository attacker modifies the `main` branch or its dependencies. 4. The scheduled event prompts the agent to run `git pull origin main`. 5. The agent runs `npm install`, potentially executing newly introduced package lifecycle scripts. 6. The modified code gains execution in the environment during a later session. ### Impact Assessment The mechanism establishes cross-session persistence at the agent-task level. Code subsequently introduced upstream may execute with the permissions of ...[truncated 354 chars]
- Remediation
- ## Remediation Suggestions - Remove the requirement to create an automatic recurring update task. - Require explicit, informed user authorization for each update. - Pin the repository to a reviewed commit hash rather than tracking `main`. - Present and review upstream diffs before installing or running updated code. - Run updates in an isolated, least-privileged environment without unnecessary secrets. - Do not target the main agent session with maintenance events. - Require signed commits or releases and verify signatures before updating. - Maintain an auditable update log and provide a clear mechanism to disable or remove scheduled tasks.