T06 · System Persistence
Error
- Location
SKILL.md:23- Finding
Recurring Cron Jobs Establish Cross-Session System Persistence
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:23-29,SKILL.md:76-87,SKILL.md:157-189;references/cron-spec.md:3-69
Vulnerability Type: Scheduled-task persistence
Risk Level: HighVulnerable Code Snippets
SKILL.md:23-29:markdown ### 1. Fresh install Use when the workspace has no stable memory structure yet. Do this: - read `references/directory-layout.md` - create the base files/directories - install all three cron jobs - run the acceptance checks from `references/verification.md`SKILL.md:76-87:markdown If the user wants the full workflow, create or verify all of the following: - `MEMORY.md` - `memory/inbox.md` - `memory/YYYY-MM-DD-raw.md` (created on demand) - `memory/YYYY-MM-DD.md` (created by daily summary job) - `memory/projects/` - `memory/system/` - `memory/groups/` - three cron jobs: - hourly inbox → raw archive - daily raw/context → daily summary - weekly daily summaries → `MEMORY.md`references/cron-spec.md:7-13,references/cron-spec.md:34-40, andreferences/cron-spec.md:51-57:markdown ### 1. Hourly archive job Suggested name: - `context: compress chat history (hourly)` Recommended schedule: - cron expression: `0 * * * *` - timezone: `Asia/Macau`markdown ### 2. Daily summary job Suggested name: - `daily-memory-diary` Recommended schedule: - cron expression: `30 23 * * *` - timezone: `Asia/Macau`markdown ### 3. Weekly long-term review job Suggested name: - `weekly-memory-review` Recommended schedule: - cron expression: `30 23 * * 0` - timezone: `Asia/Macau`Technical Analysis
The Skill directs the agent to install three recurring cron jobs rather than limiting execution to the current invocation. These jobs survive the initiating session and periodically read or modify persistent workspace state:
- The hourly job reads `memory/inbox. ...[truncated 2854 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not install any cron job merely because the Skill was loaded or initialized. Make manual operation the default.
- Obtain explicit, informed approval separately for each recurring job before installation.
- Before approval, display the complete cron payload, schedule, timezone, execution identity, affected paths, and expected side effects.
- Restrict every job to an explicitly approved workspace root and reject paths that resolve outside it.
- Run jobs with a dedicated least-privilege identity that can access only the required memory files.
- Use atomic writes, backups, and validation before clearing inbox entries or replacing
MEMORY.md. - Treat memory content as untrusted data. Cron prompts must not interpret stored text as executable instructions or authorization to invoke tools.
- Record an audit log of each run and every modified file without storing sensitive conversation content unnecessarily.
- Provide documented commands to disable and remove all three jobs, and verify their removal.
- Consider replacing recurring jobs with user-triggered commands or short-lived, explicitly authorized runs.
- Extend verification to inspect exact schedules and payload semantics, rather than checking only job names, enabled state, and workspace-path fingerprints.