T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:93
- Finding
- Destructive removal of all user cron jobs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:93` **Vulnerability Type**: Destructive scheduled-task management **Risk Level**: Medium ### Vulnerable Code ```bash crontab -r ``` ### Technical Analysis The documentation presents `crontab -r` as the command for stopping the Skill's scheduled monitoring. This command does not selectively remove this Skill's cron entries; it deletes the entire crontab belonging to the current user. The monitoring functionality only requires removing its own scheduled entries. Deleting unrelated entries exceeds the minimum scope necessary and creates an availability risk for every scheduled task under the same user account. The documentation does not instruct the user to back up the existing crontab, identify Skill-specific entries, or confirm that no unrelated jobs exist. ### Attack Path 1. A user configures this Skill alongside unrelated cron jobs. 2. The user follows the documented instructions to stop the monitor. 3. The user runs `crontab -r`. 4. The operating system removes the user's complete crontab. 5. All unrelated scheduled jobs owned by that user stop running. No privilege escalation is required; the damage is limited to scheduled tasks belonging to the user who executes the command. ### Impact Assessment Successful execution can remove unrelated backup, monitoring, synchronization, maintenance, notification, or security jobs. This may cause data loss, missed alerts, failed backups, or service degradation. The command does not grant additional privileges and cannot directly delete another user's crontab when executed without elevated permissions. Its impact is nevertheless broader than the Skill's declared functionality. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions Assign a unique marker to every cron entry created for this Skill, such as: ```cron # BEGIN xiaohongshu-monitor */5 8-17 * * * /path/to/xiaohongshu-monitor.sh */10 18-23 * * * /path/to/xiaohongshu-monitor.sh # END xiaohongshu-monitor ``` Replace the destructive instruction with a procedure that: 1. Creates a timestamped backup using `crontab -l`. 2. Removes only entries between the Skill-specific markers. 3. Preserves all unrelated cron jobs. 4. Displays the resulting crontab for user confirmation. At minimum, instruct users to run `crontab -e` and manually remove only the entries associated with this monitor. Do not recommend `crontab -r` as a routine shutdown mechanism. ]]>