T06 · System Persistence
Warning
- Location
references/market-monitoring-setup.md:25- Finding
Persistent Scheduled Agent Execution Without Explicit Consent or Automatic Expiration
- Content
View full analysis
Vulnerability Details
File Location:
references/market-monitoring-setup.md, lines 25-61
Vulnerability Type: Persistent scheduled task
Risk Level: MediumVulnerable Code
markdown ## Step 2: Create Monitoring Cron Job Use clawdbot's cron tool to create isolated job: ```json { "action": "add", "job": { "name": "Polymarket Monitor: [Market Name]", "schedule": { "kind": "every", "everyMs": 300000 }, "sessionTarget": "isolated", "payload": { "kind": "agentTurn", "message": "Monitor Polymarket market [URL]. Check for: 1) Price changes >5%, 2) Trades >$5000, 3) Pair cost <$0.98. Compare to previous state in .claude/skills/polymarket-analysis/state/[market-id].json. Alert if thresholds exceeded.", "timeoutSeconds": 120, "deliver": true, "channel": "last" }, "enabled": true } }CLI Alternative
bash clawdbot cron add \ --name "Polymarket: BTC $200k" \ --every "5m" \ --session isolated \ --message "Monitor polymarket.com/event/... for price/whale alerts" \ --deliver \ --channel lasttext ### Technical Analysis The monitoring instructions create an enabled scheduled job that launches an agent turn every five minutes and continues operating across sessions until it is manually disabled or removed. The job performs recurring network requests, reads and updates persistent market state, and delivers output through the last-used communication channel. Persistent monitoring is consistent with the Skill's declared “24/7 market monitoring” mode, so the scheduled task is not hidden and is not evidence of a covert backdoor. However, the setup procedure does not require explicit user confirmation immediately before creating the job, establish an expiration time, limit the number of executions, or bind delivery to a specifically confirmed recipient. Consequently, ...[truncated 2570 chars]- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed confirmation immediately before creating any scheduled job. Present the interval, duration, monitored market, expected network requests, and delivery destination.
- Default to one-time analysis. Create persistent monitoring only when the user expressly requests recurring execution.
- Require an expiration time or maximum run count. For example, automatically remove the job when the market resolves or after a user-selected duration.
- Avoid
"channel": "last". Require the user to select and confirm an explicit channel and recipient. - Create jobs disabled by default, then enable them only after displaying the final configuration and receiving confirmation.
- Use a restrictive monitoring payload that invokes only the audited read-only script and fixed Polymarket API hosts rather than an open-ended agent instruction.
- Record the job identifier and provide it to the user together with exact pause and removal commands.
- Prevent duplicate monitors for the same market and owner to avoid unbounded recurring resource consumption.
- Stop monitoring automatically when the market closes or resolves.
- Clearly document that scheduled monitoring survives the current conversation and continues to consume resources until expiration or removal.