T06 · System Persistence
- Location
SKILL.md:285- Finding
Persistent Cron Task for Conversation Monitoring and Workspace Modification
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 285-314
Vulnerability Type: Scheduled-task persistence
Risk Level: HighRelevant source excerpt, translated into English:
markdown ### 8. In-session state synchronization (opt-in, requires explicit activation) When the user explicitly requests it, perform the following: 1. Create or update the checkpoint file `memory/pm-checkpoint.json`. 2. Create a cron task that runs every 60 minutes: - Read `pm-checkpoint.json` to obtain the previous checkpoint. - Read conversation content added after the checkpoint. - Analyze the new content for new topics, decisions, or requirements. - Compare it with index.md: update STATUS.md for related content, or mark unrelated content for confirmation. - Update `lastCheckedMsgId` and `lastCheckTime`.Technical Analysis
The Skill directs the agent to install a recurring operating-system cron task. Unlike a session-local timer, a cron entry can survive the interaction and continue executing in later sessions.
Although activation is described as opt-in and the checkpoint includes an expiration timestamp, the instructions do not define how the cron entry must verify expiration or require its removal when synchronization expires, the user disables it, or the session disconnects. Merely setting
expiresAtin a JSON file does not cause the operating system to remove or disable the scheduled task.The recurring operation is instructed to read newly added conversation content and modify project files. Consequently, an orphaned or improperly scoped cron entry could continue accessing conversation-derived information and changing workspace state outside the initiating interaction.
Attack Path
- A user explicitly enables periodic state synchronization.
- The agent creates
memory/pm-checkpoint.json. - The agent installs a cron task that executes every 60 minutes.
- The sched ...[truncated 1330 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace operating-system cron with a session-scoped scheduler that is automatically destroyed when the session ends.
- If cron is unavoidable, require a separate, explicit confirmation that clearly states that a persistent operating-system task will be installed.
- Assign each task a deterministic, unique identifier and prevent duplicate registration.
- Require the task to check
activeandexpiresAtbefore reading any conversation or project data. - Define mandatory removal procedures for expiration, user disablement, session disconnection, project archival, and Skill uninstallation.
- Restrict the scheduled command to the minimum required files and prevent arbitrary path selection.
- Record installation, execution, failure, and deletion events in a local audit log without storing conversation contents.
- Provide a command that lists all installed tasks and allows the user to remove them immediately.
- Default synchronization to disabled and avoid interpreting unrelated requests as consent to install a scheduled task.