T06 · System Persistence
- Location
examples.md:64- Finding
Persistent Code Execution Through a Windows Scheduled Task
- Content
View full analysis
Vulnerability Details
File Location:
examples.md, line 64
Vulnerability Type: Windows scheduled-task persistence
Risk Level: HighVulnerable Code
powershell # Create scheduled task schtasks /create /tn "档案日报" /tr "node C:\Users\PC\.qoder\skills\archive-intelligence\scripts\collect-intelligence.js C:\Users\PC\.qoder\skills\archive-intelligence\examples\daily-config.json" /sc daily /st 09:00Technical Analysis
The documentation instructs the user or agent to register the Skill's JavaScript collector with Windows Task Scheduler. The task survives the current Skill invocation and executes the referenced script automatically every day.
Recurring execution is consistent with the Skill's declared scheduling feature, but the documented mechanism introduces system persistence without an explicit confirmation checkpoint, constrained execution identity, integrity verification, expiration policy, or removal procedure. It also uses files stored in a user profile as the persistent execution target. Any process capable of modifying the referenced script or configuration can affect subsequent scheduled executions.
The command does not explicitly request administrator or
SYSTEMprivileges. Therefore, the scheduled task would ordinarily operate within the registering user's security context, and no privilege escalation is demonstrated. Nevertheless, persistent execution exceeds the permissions required for single-run intelligence collection and should only be configured following explicit, informed authorization.Attack Path
- A user or agent follows the instructions in
examples.md. schtasksregisters the named task to execute every day at 09:00.- The task remains registered after the initial Skill session ends.
- A local process or account with write access to the referenced JavaScript or configuration file modifies or replaces that file.
- At the next scheduled execution, Windows launc ...[truncated 917 chars]
- A user or agent follows the instructions in
- Remediation
View remediation
Remediation Suggestions
-
Require explicit, informed user confirmation immediately before creating any scheduled task.
-
Clearly display the task name, schedule, executable, configuration file, execution identity, output location, and persistence implications before registration.
-
Prefer an application-scoped scheduler that can be managed and revoked through the hosting agent rather than creating an operating-system task.
-
If Windows Task Scheduler is necessary, run the task under a dedicated least-privileged account with access limited to the required script, configuration, and report directory.
-
Store the script and configuration in a protected directory that untrusted users and processes cannot modify.
-
Use fully quoted absolute paths for Node.js, the script, the configuration, and the output directory.
-
Validate the integrity or signature of the script and configuration before each scheduled execution.
-
Add an expiration policy or require periodic renewal instead of registering an indefinite task.
-
Document how to inspect and remove the task, including:
powershell schtasks /query /tn "档案日报" schtasks /delete /tn "档案日报" /f -
Offer a non-persistent, single-run collection mode as the default and create recurring tasks only when the user specifically requests scheduling.
-