T06 · System Persistence
Warning
- Location
- SKILL.md:25
- Finding
- Persistent Hourly Execution Through User Crontab<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 25-28 **Vulnerability Type**: Persistent scheduled task **Risk Level**: Medium ### Vulnerable Code ```bash # 设置定时任务 crontab -e 0 * * * * cd /path/to && python3 scripts/x_deep_miner.py scan ``` ### Technical Analysis The documentation instructs the user to create an indefinite hourly cron job. This establishes cross-session persistence under the user account and causes Python code from the project directory to execute automatically. Scheduled scanning is consistent with the Skill's advertised hourly automation, but the persistence exceeds what is necessary for manual operation. It is particularly disproportionate in the current implementation because `search_x_tweets()` is only a placeholder and always returns an empty result set. Consequently, the scheduled task repeatedly executes code without currently delivering the advertised automated collection functionality. The cron entry also runs a relative script from a potentially mutable project directory. If `scripts/x_deep_miner.py` or its imported local environment is later replaced or compromised, the modified code will automatically run every hour without further user interaction. The project does not provide validation of the executable path, integrity controls, a restricted execution account, or documented removal instructions. The project does not programmatically modify the crontab; persistence occurs only if a user manually follows these instructions. ### Attack Path 1. A user follows the setup instructions in `SKILL.md`. 2. The user replaces `/path/to` with the project directory and installs the supplied cron entry. 3. Cron begins invoking `scripts/x_deep_miner.py scan` every hour under that user's account. 4. An attacker or another compromised process that gains write access to the project directory modifies the scheduled Python script or relevant local code. 5. At the next hourly interval, cron executes the modified code ...[truncated 697 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make manual, on-demand execution the default workflow and remove cron installation from the basic usage instructions. 2. Offer scheduling only as an explicit, informed opt-in after the automated scanning functionality is implemented. 3. Use validated absolute paths for both the Python interpreter and script rather than relying on `cd` and a relative script path. 4. Run the task through a dedicated wrapper with a minimal environment, restrictive file permissions, and explicit logging. 5. Use a dedicated least-privileged account where practical; do not run the scheduled task as root. 6. Ensure the project directory and scheduled script are not writable by untrusted users. 7. Document how to inspect and remove the task, for example with `crontab -l` and `crontab -e`. 8. Provide a supported disable or uninstall command that removes only this Skill's scheduled entry. 9. Consider a user-visible scheduler that supports enable/disable controls and execution history instead of directly editing the crontab. 10. Add integrity or ownership checks before scheduled execution if the code remains in a mutable location. ]]>