T06 · System Persistence
Error
- Location
HEARTBEAT-CONFIG.md:27- Finding
Persistent Autonomous Agent Execution Through Scheduled Cron Jobs
- Content
View full analysis
- Remediation
View remediation
Security audit
Proactive Tasks
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but it needs review because it encourages recurring autonomous agent work and shared workspace memory writes without tight scoping or safety controls.
Install only if you intentionally want an agent to keep durable task memory and potentially run on a recurring heartbeat. Keep scheduled jobs under an unprivileged account, avoid /etc/cron.d unless necessary, review and rotate memory logs, and treat task notes, blockers, SESSION-STATE.md, working-buffer.md, WAL files, and HEARTBEAT.md as untrusted input before allowing resumed work or command execution.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T02 · Agent Memory Poisoning
Error
- Location
scripts/task_manager.py:296- Finding
Persistent Agent Memory Poisoning Through Unsanitized Task Content
- Content
View full analysis
None: """Update SESSION-STATE.md with current task context.""" progress = task.get("progress", 0) estimate = task.get("estimate_minutes", 0) actual = task.get("actual_minutes", 0) status = task.get("status", "pending") velocity = "" if estimate > 0: ratio = actual / estimate if ratio < 1: velocity = f"{int((1 - ratio) * 100)}% faster than estimate" elif ratio > 1: velocity = f"{int((ratio - 1) * 100)}% slower than estimate" else: velocity = "on pace with estimate" content = f"""# SESSION-STATE.md - Active Working Memory Last updated: {datetime.now(timezone.utc).isoformat()} ## Current Task - ID: {task.get("id", "unknown")} - Title: {task.get("title", "N/A")} - Status: {status} - Progress: {progress}% - Estimated: {estimate} min - Actual logged: {actual} min {f"({velocity})" if velocity else ""} ## Goal Context - ID: {goal.get("id", "unknown")} - Title: {goal.get("title", "N/A")} - Priority: {goal. ...[truncated 4575 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The public description frames the skill as task tracking and proactive work management, but the body adds broader persistence, session-memory reconstruction, automatic health-check repair, and background-oriented operational behavior. This mismatch is dangerous because users or orchestration systems may grant the skill routine planning access without realizing it can autonomously write durable memory artifacts and modify task state outside narrow task-tracking expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This documentation instructs autonomous background agents to write memory files and logs during isolated runs, but it does not clearly warn users that persistent workspace state will be modified automatically. In a proactive/autonomous task skill, silent file writes are security-relevant because they can change project state, consume storage, and create unexpected persistence channels without explicit operator awareness or consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The cron example appends autonomous health-check output to a persistent log file using shell redirection, but the document does not provide a user-facing warning that scheduled background execution will continuously modify files. Because this skill is specifically designed for autonomous operation, undocumented recurring writes increase the risk of unnoticed persistence, log growth, and unintended disclosure of task or environment data.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
-
Verify heartbeat fires:
bash crontab -l # Should show your heartbeat job -
Test heartbeat message locally:
-
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README explicitly instructs agents to run the task manager on every heartbeat, perform work autonomously, and log progress/time, which normalizes unattended state changes to local data. In an agent-skill context, this is risky because it encourages continuous autonomous execution and file modification without clear operator consent boundaries, safety checks, or warnings about persistent side effects to tasks.json and related workflow state.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to read and write multiple files (
data/tasks.json, WAL logs,SESSION-STATE.md,working-buffer.md, memory files) but declares no explicit tool scope or permissions boundary. In an autonomous skill, undeclared file access increases the chance of over-broad invocation and unauthorized persistence or modification of workspace data beyond what a user expects.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation language is broad enough to match many normal planning or project discussions, which can cause the skill to trigger when the user only wants lightweight advice rather than persistent autonomous task management. In that context, the skill may begin creating durable records or steering behavior toward background autonomy without sufficiently clear intent from the user.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The recovery trigger includes generic phrases like being asked to 'continue' or 'where were we?', which are common in ordinary conversation and may spur unsolicited file reads and recovery actions. That broad trigger can cause the agent to consult persistence artifacts and rehydrate prior context when the user did not intend session-state recovery, increasing privacy and boundary risks.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill directs operators to create a cron job that periodically sends heartbeat messages, establishing ongoing autonomous execution and session persistence beyond the immediate user interaction. Scheduled re-entry materially raises risk because the agent can continue reading/writing state and taking action without fresh user intent, especially when paired with broad activation and persistent memory files.
- Content
md **Quick setup:** See [HEARTBEAT-CONFIG.md](HEARTBEAT-CONFIG.md) for complete setup instructions and patterns. **TL;DR:** 1. Create a cron job that sends you a heartbeat message every 30 minutes 2. Add proactive-tasks checks to your `HEARTBEAT.md` 3. You'll automatically check for tasks and work on them without waiting for prompts
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script is not limited to its own task database: it also writes to workspace-level files such as SESSION-STATE.md and memory/working-buffer.md. Because task titles, notes, blockers, and progress are user/agent-provided content, this creates persistent cross-session state outside the primary datastore and can expose or influence unrelated agent workflows that read those files later.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python print(json.dumps({"success": True, "goal": goal}, indent=2)) def add_task(args) -> None: """Add a task to a goal.""" data = load_data() # Find the goal
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python print(json.dumps({"success": True, "goal": goal}, indent=2)) def add_task(args) -> None: """Add a task to a goal.""" data = load_data() # Find the goal
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The WAL feature writes detailed task events into workspace-level log files under memory/, extending retention of operational data beyond core task storage. This broadens the data exposure surface, duplicates potentially sensitive notes and identifiers, and creates a durable audit trail that other tools or agents may consume unexpectedly.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
update_session_state persists task notes, blockers, progress, and contextual goal information into SESSION-STATE.md, which is a workspace-level memory artifact intended for later resurfacing. This increases the risk of sensitive user-provided content being retained longer than expected and being consumed by other agents or tools as trusted context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The health-check command is described as a check/report function but silently mutates task records and persists those changes. Hidden self-healing behavior is dangerous because an agent or user may invoke what appears to be read-only validation and instead trigger state changes, data tampering, or loss of forensic accuracy without consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Automatic repair logic modifies task files without user confirmation or an explicit warning, even though the command name suggests inspection. In an autonomous-agent setting, this can cause unintended writes, conceal upstream corruption, and make it easier for malicious or buggy inputs to trigger state changes under the guise of maintenance.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
flush_buffer consolidates captured task updates from the working buffer into a daily memory journal, promoting durable retention and resurfacing of operational history. This can propagate sensitive or misleading content across sessions and make ephemeral task metadata part of a broader workspace memory corpus.
- Content
Static analysis
No suspicious patterns detected.