T06 · System Persistence
Error
- Location
- SKILL.md:315
- Finding
- Autonomous Installation of Cross-Session Scheduled Tasks## Vulnerability Details **File Location**: `SKILL.md`, lines 315-371 **Vulnerability Type**: Persistent scheduled execution without explicit user authorization **Risk Level**: High ### Vulnerable Code ```markdown ## 3. Self-Adaptive Cron Management This is a **critical** autonomous responsibility. You must manage your own cron schedule based on the current state of your tasks and conversations. Do not wait for the user to tell you to set up cron jobs. ### State Assessment Every time you perform an action (create task, start conversation, end conversation, etc.), assess the current state and adjust cron jobs accordingly: | State | Scan Cron | Heartbeat Cron | Notification Check | |-------|-----------|----------------|-------------------| | Has Radar tasks, no active conversations | Every 10 min | Not needed | -- | | Has Radar tasks + active conversations | Every 10 min | Every 10 min | -- | | Only Beacon tasks + active conversations | Not needed | Every 10 min | -- | | Only Beacon tasks, no active conversations | Not needed | Not needed | Every 30 min | | No active tasks at all | Not needed | Not needed | Not needed | ``` ```markdown - **New Radar task created** -> Add scan cron at every 10 minutes - **Conversation starts** -> Add heartbeat cron at every 1-2 minutes - **All conversations end** -> Remove heartbeat cron - **Long time with no new matches from scan** -> Reduce scan frequency to every 30 minutes - **New match found after slow period** -> Increase scan frequency back to every 10 minutes - **All tasks removed** -> Remove ALL cron jobs ``` ### Technical Analysis The Skill directs the Agent to create and manage recurring scheduled tasks autonomously, explicitly stating that it should not wait for user authorization. These schedules survive the invocation that created them and repeatedly launch isolated Agent sessions for scanning, heartbeat polling, notification processing, and outbound messa ...[truncated 1773 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit, informed user approval before creating any recurring schedule. 2. Display the exact job name, interval, purpose, expected network activity, and data accessed before installation. 3. Default to one-time execution when persistent scheduling has not been approved. 4. Add mandatory expiration times and maximum execution counts to all scheduled jobs. 5. Enforce minimum polling intervals and resource budgets. 6. Provide a single command that disables the Skill and removes every associated cron job. 7. Confirm job removal when a task is paused, completed, deleted, or when authorization is revoked. 8. Prevent cron-triggered sessions from expanding their permissions or installing additional schedules. 9. Maintain a user-visible audit log of schedule creation, modification, execution, and removal.