T06 · System Persistence
Error
- Location
- SKILL.md:102
- Finding
- Recurring Scheduled Tasks Create Cross-Session Persistence<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 102-116 **Vulnerability Type**: Scheduled task persistence **Risk Level**: High ### Evidence ```markdown ### Daily Ideas (Cron) Set up a daily cron to generate ideas: ``` Schedule: 07:00 daily Task: Generate 5 content ideas based on overnight trends. Save to content-ideas/daily/YYYY-MM-DD.md ``` ### Weekly Content Calendar ``` Schedule: Sunday 20:00 Task: Generate 15-20 content ideas for the week. Organize by platform and day. Save to content-ideas/weekly/YYYY-WW.md ``` ``` ### Technical Analysis The skill explicitly directs the agent to establish daily and weekly cron-style tasks. Such tasks survive the initiating interaction and cause the content-generation workflow to execute unattended in later sessions. When followed by an agent with access to a scheduler, the instructions can create persistent behavior involving repeated requests to external RSS feeds, Reddit, Hacker News, X/Twitter, and web-search services. The resulting content is then written to local daily or weekly output paths. The scheduling feature is related to the skill's trend-monitoring purpose, and no hidden backdoor or malicious executable was identified. Nevertheless, registering recurring jobs is a persistence mechanism and exceeds the requirements of ordinary on-demand content generation. The instructions do not require explicit confirmation immediately before registration, define a termination date, or provide a procedure for inspecting and removing created jobs. ### Attack Path 1. A user or agent loads the skill and requests content generation or trend monitoring. 2. The agent reaches the documented daily or weekly scheduling workflow. 3. If the agent has scheduler access, it registers a recurring task using the described schedule. 4. The scheduled task survives the original skill run and executes daily or weekly. 5. Each unattended execution can query configured external sources and write generated con ...[truncated 1128 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make on-demand execution the default and remove instructions that automatically establish recurring jobs. 2. Require explicit, task-specific user confirmation immediately before creating any scheduled task. 3. Before confirmation, display: - The exact schedule and time zone. - The command or workflow that will execute. - Every expected external network destination. - All output paths that may be created or modified. - The account and privilege context under which the task will run. 4. Add an expiration date or bounded execution count so scheduled jobs cannot persist indefinitely. 5. Use the least-privileged account available and restrict filesystem writes to a dedicated output directory. 6. Provide exact commands or platform-specific steps for listing, disabling, and deleting every registered job. 7. Record scheduling actions in an audit log and clearly identify jobs as belonging to this skill. 8. Require renewed authorization before changing the schedule, sources, output paths, or execution privileges. 9. If scheduling is retained, separate it from the core skill into an optional setup procedure rather than presenting it as part of the ordinary workflow. ]]>