T06 · System Persistence
Error
- Location
SKILL.md:103- Finding
Persistent Scheduled Task Installation Replaces the User's Existing Crontab
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 103-107
Vulnerability Type: Scheduled-task persistence and destructive crontab replacement
Risk Level: HighComplete Code Snippet:
markdown ## Automatic Tracking The current version supports manual start/stop tracking. Automatic reports can be enabled via cron jobs: ```bash # Add to crontab to generate daily report at 22:00 echo "0 22 * * * /usr/local/bin/time-analyzer report" | crontab -text ### Technical Analysis The documented command installs a recurring cron task that survives the current Skill invocation and runs `/usr/local/bin/time-analyzer report` every day at 22:00. This constitutes cross-session system persistence. Scheduled report generation is related to the Skill's reporting functionality, but persistence is not necessary for its core manual tracking, analysis, and on-demand reporting features. It should therefore be an explicit, carefully implemented opt-in feature. The command is also destructive. `crontab -` treats standard input as the user's complete replacement crontab. Because the command supplies only one line, following the instructions replaces all existing cron entries rather than appending a new entry. ### Attack Path 1. A user installs the CLI globally and follows the automatic-report instructions in `SKILL.md`. 2. The shell sends a single cron entry to `crontab -`. 3. The user's existing crontab is replaced, deleting any previously configured scheduled jobs. 4. The `time-analyzer report` command executes automatically every day at 22:00 under the affected user's account. 5. If `/usr/local/bin/time-analyzer` is subsequently replaced or compromised, the replacement code is also executed automatically by cron. ### Impact Assessment The immediate scope is the invoking user's crontab and account privileges. Existing scheduled tasks may be silently removed, potentially disrupting backups, maintenance, ...[truncated 318 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the direct
echo ... | crontab -instruction. - Keep scheduled reporting explicitly opt-in and clearly disclose that it creates a persistent user-level task.
- Prefer instructing users to add the entry through
crontab -e, which avoids replacing unrelated entries. - If automation is provided, safely merge a uniquely marked entry with the existing crontab, validate that it is not already present, and preserve all unrelated jobs.
- Resolve and quote the actual executable path rather than assuming
/usr/local/bin/time-analyzer. - Provide a matching uninstall command that removes only the uniquely marked Time Analyzer entry.
- Display the proposed schedule and obtain explicit confirmation before installation.
- Document the permissions and execution environment used by the cron task.
- Remove the direct