T06 · System Persistence
- Location
SKILL.md:143- Finding
Persistent Autonomous Agent Execution Through Scheduled Cron Jobs
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 143–147
Vulnerability Type: Persistent scheduled execution with broad autonomous activity
Risk Level: Highmarkdown ## Getting Started 1. Create `HEARTBEAT.md` in your workspace using the template above 2. Create `memory/heartbeat-state.json` to track check timestamps 3. Set up 2-3 cron jobs for your most important recurring tasksSupporting instructions broaden the activities performed by the persistent jobs:
markdown **Memory Maintenance (weekly):**Review all memory/YYYY-MM-DD.md files from the past week. Update MEMORY.md with significant events and lessons. Archive or summarize old daily files.
text **Social Pulse (every 6h):**Check Twitter mentions and DMs. Review any Discord channels for relevant conversations. Post something interesting if inspiration strikes.
text markdown Things your agent can do without asking: ### Low Risk (do freely) - Organize and clean up workspace files - Update documentation - Review and commit git changes - Maintain memory files - Read and summarize saved articles - Check system health (disk space, processes)Technical Analysis
The Skill instructs users to establish heartbeat files, persistent state, and multiple cron jobs. Cron jobs continue to execute after the interaction that created them, making this a cross-session persistence mechanism.
The scheduled execution model is combined with instructions to access communications, inspect memory, examine system processes, modify workspace content, and commit Git changes. These operations can affect private information and repository state without fresh authorization for each scheduled run. Persistent task content also creates a reusable execution path: if a heartbeat file or scheduled instruction is later modified, subsequent invocations can repeatedly perform the modified behavior.
The project c ...[truncated 1774 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the default recommendation to create multiple cron jobs.
- Require explicit, informed user approval for each scheduled task, including its exact schedule, data sources, permitted tools, and allowed side effects.
- Default scheduled jobs to read-only behavior and prohibit file deletion, workspace cleanup, Git commits, public posting, and external communication.
- Use dedicated least-privilege credentials for each integration rather than inheriting all permissions available to the interactive agent.
- Restrict scheduled tasks to an allowlisted set of files, repositories, accounts, and API operations.
- Protect
HEARTBEAT.md, cron definitions, and related state files from unauthorized modification through ownership and permission controls. - Log each scheduled invocation, resource accessed, tool call, modification, and failure in an audit trail visible to the user.
- Provide expiration times and execution limits so scheduled tasks automatically disable themselves unless explicitly renewed.
- Document commands or procedures to list, pause, and remove every installed heartbeat or cron task.
- Require separate confirmation before accessing private communications, altering persistent memory, committing Git changes, or performing external actions.