T06 · System Persistence
- Location
SKILL.md:70- Finding
Persistent Scheduled Monitoring Task Without Lifecycle Controls
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 70–73
Vulnerability Type:T06: System Persistence
Risk Level: HighVulnerable Skill Instructions (English translation of the complete affected segment):
markdown ### Step 3: Set Up a Scheduled Task Use the cron tool to create a scheduled inspection task: - Interval: the user-configured checkIntervalMin - Task: revisit the product page, compare prices, and send an alert if a change occursTechnical Analysis
The Skill directs the Agent to create a recurring cron task. A cron entry can remain active after the initiating Skill run or interactive session has ended, giving the monitoring operation cross-session persistence.
Although recurring monitoring is related to the declared functionality, the instructions do not require explicit confirmation immediately before persistence is established. They also provide no expiration time, maximum execution count, task identifier, ownership record, status command, pause operation, or removal workflow. Consequently, the scheduled activity can continue indefinitely and repeatedly access user-provided product URLs.
The persisted task executes with the permissions available to the account or Agent environment that creates the cron entry. The finding does not establish privilege escalation, arbitrary code execution, or a hidden backdoor; its risk arises from an inadequately controlled persistent scheduled task.
Attack Path
- A user invokes the Skill and provides a product URL and monitoring interval.
- The Agent opens the product page and records initial baseline information.
- Following
SKILL.md, the Agent creates a recurring cron task. - The cron task continues revisiting the supplied URL at the selected interval after the original interaction ends.
- Because the Skill specifies no expiration or automatic cleanup, the task remains active until it is independently identified and manuall ...[truncated 957 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed user confirmation immediately before creating any scheduled task. Display the exact interval, targets, expected network activity, expiration, and storage behavior.
- Prefer session-scoped or manually initiated checks by default. Make persistent scheduling an explicit opt-in feature.
- Require an expiration timestamp or bounded execution count for every task and automatically delete expired cron entries.
- Enforce safe scheduling limits, including a minimum interval, a maximum number of monitored products, request-rate controls, and backoff after errors or platform throttling.
- Validate target URLs before scheduling. Permit only approved
httpsdestinations and reject local, loopback, link-local, private-network, metadata-service, and unsupported URL schemes. - Return the cron task identifier, exact schedule, creation time, expiration time, and monitored targets to the user.
- Provide documented commands to list, inspect, pause, resume, and permanently delete monitoring tasks.
- Remove or archive associated baseline data, history, and screenshots when a task is deleted, according to an explicit retention policy.
- Run the task under a dedicated least-privileged identity with only the network and storage access necessary for monitoring.
- Maintain an auditable record of task creation, execution, modification, expiration, and deletion.