T06 · System Persistence
Error
- Location
references/cron-design-reference.md:157- Finding
Mandatory Installation of a Persistent macOS LaunchAgent
- Content
View full analysis
.plist ``` ```xml ProgramArguments /usr/bin/python3 StartCalendarInterval Hour 9 Minute 0 ``` ```bash launchctl load ~/Library/LaunchAgents/.plist launchctl list | grep launchctl start # 手动触发 launchctl unload ~/Library/LaunchAgents/.plist ``` The mandatory development process subsequently requires: ```text 6. 创建 plist，直接调用 python3 脚本（非 bash 包装） 7. launchctl load + launchctl start 验证 ``` ### Technical Analysis The reference instructs the Agent to create a plist in the user's `~/Library/LaunchAgents` directory and register it with `launchctl`. A loaded LaunchAgent persists beyond the immediate Skill invocation and can execute the generated Python program according to a schedule. Scheduled execution may be legitimate when the user explicitly requests recurring automation. However, the documented process treats registration and immediate execution as mandatory parts of cron-script development and does not require explicit approval before creating or loading the service. It also does not constrain the generated program's filesystem access, network destinations, or available environment. This exceeds minimum privilege for ordinary content collection, report generation, or one-shot publishing tasks. Those tasks can be completed without creating cross-session system state. ### Attack Path 1. A task is interpreted as requiring scheduled or cron-style execution. 2. ...[truncated 994 chars]- Remediation
View remediation
.plist rm ~/Library/LaunchAgents/.plist ``` 9. Record installation and removal in an auditable log. 10. Never make `launchctl load` or `launchctl start` mandatory merely because a cron-related script was developed. ]]>