T06 · System Persistence
Error
- Location
- SKILL.md:45
- Finding
- Persistent Scheduled Execution Through Undisclosed Cron Configuration## Vulnerability Details **File Location**: `SKILL.md`, lines 45 and 119 **Vulnerability Type**: Persistent scheduled-task installation **Risk Level**: High ### Vulnerable Code ```text | `gogetajob watch` | Set up automatic sync via cron | ``` ```text Run `gogetajob sync` regularly (or use `gogetajob watch` for automatic cron). ``` ### Technical Analysis The skill recommends `gogetajob watch`, which creates a recurring cron task that survives the current workflow and agent session. The documentation does not disclose the exact cron entry, executable path, schedule, environment, permissions, log destination, or removal procedure. Because the scheduled command belongs to a separately installed third-party package, later package changes or executable replacement could alter what the persistent task runs. This crosses the boundary from a temporary contribution workflow into durable system modification. ### Attack Path 1. A user or agent follows the documented workflow and installs the GoGetAJob CLI. 2. The user or agent invokes `gogetajob watch`. 3. The CLI creates a cron entry under the user's account. 4. The cron entry continues executing after the original skill run ends. 5. If the package, executable, executable-resolution path, or configuration is later compromised, attacker-controlled behavior runs automatically on the cron schedule. ### Impact Assessment Exploitation could provide repeated code execution with the permissions of the account owning the cron entry. The effective scope may include that user's repositories, Git configuration, locally accessible credentials, authenticated CLI sessions, and writable files. The finding does not demonstrate root-level persistence, but it establishes cross-session persistence at user privilege.
- Remediation
- ## Remediation Suggestions - Do not install a cron task by default; make synchronization an explicit, one-time operation. - Require informed user approval immediately before creating any scheduled task. - Display the exact cron expression, absolute executable path, arguments, environment, and output destination before installation. - Pin and verify the executable that the cron entry invokes. - Avoid relying on mutable `PATH` resolution in scheduled tasks. - Document commands for inspecting, disabling, and completely removing the cron entry. - Constrain the scheduled process to minimum filesystem and network permissions. - Prefer a user-visible scheduler with auditable configuration and expiration over indefinite persistence.