T06 · System Persistence
- Location
SKILL.md:441- Finding
Mandatory Recurring Task Creates Cross-Session Persistence
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 441–452
Vulnerability Type: Mandatory scheduled task with recurring access to persistent memory
Risk Level: HighComplete Vulnerable Source Excerpt
The following is an English translation of the relevant source instructions:
markdown This is the most valuable feature, but it is also the easiest to forget. A recurring reminder must be configured; it cannot depend on remembering it. Method: Use your scheduling system to create a task that repeats every two weeks: Scan USER.md and MEMORY.md and find preferences and experiences that have not been validated for more than two weeks. If any exist, select the one or two most valuable items and proactively ask the user. Wording: "Regarding the thing we agreed on before... I have continued doing it this way recently. Do you think it is still correct?" If none exist, do not disturb the user. Key point: The schedule must be configured. Do not rely on remembering it. You will not remember.Technical Analysis
The Skill explicitly requires the Agent to use an available scheduling system to create a task that repeats every two weeks. This is not presented solely as an optional example: the instructions repeatedly state that the task “must” be configured.
A scheduled task survives the interaction in which the Skill is loaded and subsequently executes without a new invocation of the Skill. Its payload also accesses
USER.mdandMEMORY.md, selects stored information, and initiates a new interaction with the user.This behavior meets the definition of system persistence because it installs recurring, cross-session execution through a scheduler. The Python CLI does not create the task itself; the persistence is induced through instructions executed by the hosting Agent.
Attack Path
- A user installs or invokes the Skill.
- The Agent loads and follows
SKILL.md. - The Skill instructs the Agent to access its scheduling or calend ...[truncated 1215 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove all language requiring automatic schedule creation.
- Treat recurring checks as an optional feature that is disabled by default.
- Obtain explicit, informed user confirmation immediately before creating a schedule.
- Display the exact recurrence interval, task payload, files accessed, and expected notification behavior.
- Restrict the scheduled task to Skill-specific, non-sensitive state rather than shared
USER.mdandMEMORY.mdfiles. - Apply a finite expiration date or execution count instead of creating an indefinite recurring task.
- Provide clear commands for reviewing, pausing, and deleting the schedule.
- Record creation and execution events in an auditable activity log.
- Require fresh authorization before expanding the task’s permissions or accessed data.
- Ensure uninstalling or disabling the Skill also removes any schedules it created.