T06 · System Persistence
- Location
SKILL.md:16- Finding
Automatic Creation of Persistent Scheduled Tasks
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:16-21
Vulnerability Type: Automatic cross-session scheduled-task persistence
Risk Level: HighVulnerable Code Snippet
markdown 配置完成后，系统**自动**： 1. 保存配置到 `config/settings.json` 2. 记录今日打卡到 `data/checkins.txt` 3. 创建两个定时任务： - 提醒任务：每天设定时间发送飞书提醒 - 检查任务：提醒后15分钟检查打卡状态Technical Analysis
The Skill instructs the agent to create two recurring scheduled tasks automatically after configuration. These tasks are intended to survive the initiating interaction and continue sending reminders and checking activity in later sessions.
No explicit final confirmation is required immediately before task creation. The instructions also omit task identifiers, expiration rules, duplicate-task prevention, ownership verification, scheduler restrictions, and a documented removal process. Consequently, repeated activation could produce duplicate tasks, while obsolete tasks could continue operating with stale or attacker-supplied destination information.
The repository contains no executable scripts or scheduler implementation, so exploitation depends on an agent runtime that follows the instructions and has access to a scheduling facility.
Attack Path
- A user or attacker activates the Skill.
- The actor supplies a reminder time and a Feishu group identifier.
- Following
SKILL.md, an agent with scheduler permissions automatically creates recurring reminder and check tasks. - The tasks remain active after the original interaction ends.
- If configuration becomes stale, is attacker-controlled, or is configured repeatedly, persistent tasks can continue sending messages or initiating follow-up actions without renewed authorization.
Impact Assessment
Exploitation does not grant operating-system privileges beyond those already available to the agent. However, it allows continued use of the agent's scheduling and communication capabilities across ...[truncated 206 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed confirmation immediately before creating each scheduled task.
- Display the schedule, destination, action, expiration date, and potential emergency-call behavior in the confirmation prompt.
- Use a constrained application scheduler rather than unrestricted system scheduling.
- Assign stable, unique task identifiers and check for an existing task before creating another.
- Verify that the configuring user owns or is authorized to use the Feishu destination and emergency contact.
- Provide commands to list, pause, update, and permanently remove all tasks created by the Skill.
- Add automatic expiration and require periodic reauthorization.
- Prevent scheduled tasks from making calls without an additional controlled escalation and confirmation mechanism where feasible.
- Record task creation and removal events without exposing sensitive contact information.