T06 · System Persistence
Error
- Location
- SKILL.md:103
- Finding
- Persistent Scheduled Task Installation Replaces the User's Existing Crontab## Vulnerability Details **File Location**: `SKILL.md`, lines 103-107 **Vulnerability Type**: Scheduled-task persistence and destructive crontab replacement **Risk Level**: High **Complete Code Snippet**: ```markdown ## Automatic Tracking The current version supports manual start/stop tracking. Automatic reports can be enabled via cron jobs: ```bash # Add to crontab to generate daily report at 22:00 echo "0 22 * * * /usr/local/bin/time-analyzer report" | crontab - ``` ``` ### Technical Analysis The documented command installs a recurring cron task that survives the current Skill invocation and runs `/usr/local/bin/time-analyzer report` every day at 22:00. This constitutes cross-session system persistence. Scheduled report generation is related to the Skill's reporting functionality, but persistence is not necessary for its core manual tracking, analysis, and on-demand reporting features. It should therefore be an explicit, carefully implemented opt-in feature. The command is also destructive. `crontab -` treats standard input as the user's complete replacement crontab. Because the command supplies only one line, following the instructions replaces all existing cron entries rather than appending a new entry. ### Attack Path 1. A user installs the CLI globally and follows the automatic-report instructions in `SKILL.md`. 2. The shell sends a single cron entry to `crontab -`. 3. The user's existing crontab is replaced, deleting any previously configured scheduled jobs. 4. The `time-analyzer report` command executes automatically every day at 22:00 under the affected user's account. 5. If `/usr/local/bin/time-analyzer` is subsequently replaced or compromised, the replacement code is also executed automatically by cron. ### Impact Assessment The immediate scope is the invoking user's crontab and account privileges. Existing scheduled tasks may be silently removed, potentially disrupting backups, maintenance, ...[truncated 318 chars]
- Remediation
- ## Remediation Suggestions - Remove the direct `echo ... | crontab -` instruction. - Keep scheduled reporting explicitly opt-in and clearly disclose that it creates a persistent user-level task. - Prefer instructing users to add the entry through `crontab -e`, which avoids replacing unrelated entries. - If automation is provided, safely merge a uniquely marked entry with the existing crontab, validate that it is not already present, and preserve all unrelated jobs. - Resolve and quote the actual executable path rather than assuming `/usr/local/bin/time-analyzer`. - Provide a matching uninstall command that removes only the uniquely marked Time Analyzer entry. - Display the proposed schedule and obtain explicit confirmation before installation. - Document the permissions and execution environment used by the cron task.