T06 · System Persistence
Warning
- Location
- SKILL.md:26
- Finding
- Unbounded Persistent Execution Through a Recurring Cron Job## Vulnerability Details **File Location**: `SKILL.md`, lines 26-44 and 65-80; corroborated by `_meta.json`, lines 11-17 **Vulnerability Type**: T06: System Persistence **Risk Level**: Medium ### Evidence The following is an English translation of the relevant workflow documented in `SKILL.md`: ```text Cron trigger (every 5 minutes) ↓ Read research_pool.json ↓ Check pending_topics ↓ Topic available → randomly select one No topic available → generate three new topics ↓ Perform in-depth research and create a Feishu document ↓ Move the topic to completed and generate three new topics ↓ Send a summary to Feishu ↓ Error → exit immediately (Cron automatically starts it again) ``` The persistence and lack of execution limits are further documented as follows: ```text Error-handling principles: - On error, exit immediately without retrying or changing the model. - Cron automatically starts a new task. - If the system kills the task, rely on Cron to recover. Quality-control principles: - The model resolves research-quality problems itself. - Do not wait for human confirmation. - Control frequency through the five-minute interval. - No daily limit. ``` `_meta.json` confirms the scheduled-job configuration: ```json "cron_job": { "id": "274198b3-ca0c-456c-b55f-d94ce0049121", "name": "Autonomous Research Infinite Loop", "interval_minutes": 5, "next_run": "2026-04-02T10:00:00+08:00" } ``` ### Technical Analysis The skill is designed around a recurring scheduled task that runs every five minutes and restarts processing after either successful completion or failure. It explicitly requires no human confirmation and imposes no daily execution limit. This creates cross-session persistence rather than limiting execution to a single user-invoked skill run. Each iteration can generate additional pending topics, perform model-backed research, cre ...[truncated 2342 chars]
- Remediation
- ## Remediation Suggestions 1. Disable recurring execution by default and require an explicit administrator action to install or enable any scheduled task. 2. Replace the infinite loop with a bounded job that processes a fixed number of topics and then terminates permanently. 3. Require user approval before each research run and before creating or sending content to Feishu. 4. Enforce daily limits for runs, token usage, generated topics, document creation, and outbound messages. 5. Add a circuit breaker that disables the schedule after repeated failures, quota exhaustion, or abnormal output volume. 6. Prevent automatic queue growth by placing a strict upper bound on pending topics and requiring approval before adding more. 7. Provide documented disable and uninstall procedures that remove the Cron entry and revoke associated Feishu credentials. 8. Run the workflow under a dedicated unprivileged service account rather than relying on paths under `/root`. 9. Restrict filesystem and Feishu permissions to only the specific files, folders, and destinations required for the task. 10. Log every scheduled invocation, state change, document creation, and outbound message, and expose the logs to administrators. 11. Reconcile the package manifest with the delivered artifact: `_meta.json` lists `research_pool.json` and `research_loop.md`, but those files were absent from the audited package.