T06 · System Persistence
Error
- Location
SKILL.md:15- Finding
Persistent Autonomous Cleanup Enables Destructive Cross-Session Operations
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 15–16, 21–32, 46–62, and 91–109
Vulnerability Type: Persistent scheduled execution and excessive session-management authority
Risk Level: HighVulnerable Code
markdown | Sub-agent idle > 30min | Terminate automatically | | Old sessions (> 7 days) | Archive or delete |markdown No special setup required. The skill automatically: 1. **Monitors session sizes** - Checks if current session context is growing too large 2. **Terminates idle sub-agents** - Stops sub-agents that haven't been used recently 3. **Archives old sessions** - Moves completed sessions to archive 4. **Compresses context** - Replaces verbose message chains with summaries ## Usage ### Automatic Operation The skill runs automatically during heartbeat checks when context size exceeds thresholds.markdown Use `sessions_list` and `subagents` tools internally. The skill orchestrates: 1. List all sessions 2. Check sub-agent status 3. Terminate idle sub-agents 4. Compress large contexts 5. Archive old sessionsmarkdown 3. **Replace verbose content** - Keep only essential informationmarkdown ### Heartbeat Integration Add to `HEARTBEAT.md`: ```markdown ## 上下文管理 - [ ] 检查会话大小 - [ ] 清理过期子代理 - [ ] 压缩过大上下文Cron Integration
Schedule regular cleanup:
bash # Weekly full cleanup cron add -name "weekly-context-clean" -schedule "0 3 * * 0" -payload "Compress contexts and clean expired sessions"text ### Technical Analysis The Skill instructs an agent to establish recurring execution through heartbeat configuration and a weekly cron task. These mechanisms survive the individual Skill invocation and repeatedly trigger cleanup behavior in later sessions, matching system persistence. The persistent process is granted authority to enumerate all sessions, terminate sub-agents, rewrite co ...[truncated 2707 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the heartbeat and cron installation instructions. Cleanup should run only after an explicit, current user request.
- Default to a read-only audit that lists cleanup candidates and explains why each candidate was selected.
- Require separate, explicit confirmation before every session deletion, context replacement, archive operation, or sub-agent termination.
- Restrict management operations to the current session unless the user explicitly identifies other sessions by stable identifier.
- Do not infer authorization from age or inactivity alone. Verify task completion, pending work, ownership, locks, and active processes.
- Preserve original context. Store summaries as additional metadata rather than replacing source messages.
- Prefer reversible archival over deletion and create a verified backup before any mutation.
- Provide dry-run, restoration, retention, and rollback mechanisms.
- Enforce least-privilege tool access so the Skill cannot modify scheduler or heartbeat configuration by default.
- Record an audit log containing the initiating user, authorization decision, affected resource, action, timestamp, and restoration location.
- Correct the statement that no special permissions are needed and document every required capability.
- If scheduled maintenance is genuinely necessary, require an administrator-approved policy with narrowly scoped targets, non-destructive defaults, and per-run reporting.