T06 · System Persistence
Warning
- Location
- routines.md:29
- Finding
- Uncontrolled Persistent Reminder Creation Through Cron## Vulnerability Details **File Location**: `routines.md:29-34` **Vulnerability Type**: `T06: System Persistence` **Risk Level**: Medium ### Vulnerable Code ```markdown ### Recurring Reminders Set via cron jobs: - **Daily:** Feeding, walks, medication - **Weekly:** Grooming, training sessions - **Monthly:** Flea treatment, food reorder, weigh-in - **Yearly:** Vaccination due, license renewal ``` ### Technical Analysis The skill explicitly directs the agent to implement recurring reminders using cron jobs. Cron entries persist across agent sessions and execute automatically under the account that installed them. The instructions do not define: - An allowlist of permitted reminder commands - Safe argument handling or prohibition of shell interpretation - Explicit user confirmation before installing persistent tasks - Ownership markers identifying entries created by this skill - Limits on execution frequency - A removal, expiration, or revocation process - Validation that an existing cron entry belongs to this skill before modification Although the project contains no concrete malicious cron payload, the instruction establishes an unmanaged system-persistence mechanism. If reminder content or generated commands are incorporated into a cron entry without strict validation, attacker-controlled input could potentially influence a persistent command. This latter command-injection scenario depends on the agent's implementation and is not independently demonstrated by the reviewed files. ### Attack Path 1. A user or attacker with access to the conversation requests a recurring pet-related reminder. 2. The agent follows `routines.md` and creates a cron entry. 3. The scheduled task is installed in the user's crontab and survives the current skill invocation and future sessions. 4. The entry continues executing until manually removed. 5. If an unsafe implementation interpolates untrusted reminder text into a ...[truncated 819 chars]
- Remediation
- ## Remediation Suggestions 1. Replace cron with a platform-approved reminder or scheduling API that stores structured reminder data rather than executable shell commands. 2. Require explicit user confirmation before creating, changing, or deleting any recurring task. Display the schedule, action, duration, and destination before installation. 3. Represent reminders as validated structured fields. Never interpolate free-form user text into a shell command. 4. If cron is unavoidable, invoke a fixed, audited executable with strictly validated arguments and without `sh -c`, `eval`, command substitution, or shell redirection. 5. Add a unique skill-owned identifier to every entry and modify or remove only entries bearing that identifier. 6. Default reminders to an expiration date and provide commands to list, pause, and permanently remove all tasks created by the skill. 7. Enforce minimum execution intervals and quotas to prevent excessive scheduled execution. 8. Log every creation, modification, and deletion with the exact schedule and action. 9. Install tasks only in the requesting user's context. Never request elevated privileges or write to system-wide cron locations.