T06 · System Persistence
Warning
- Location
- SKILL.md:78
- Finding
- Persistent Recurring Task Is Created Without Explicit User Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 78-84 **Vulnerability Type**: `T06: System Persistence` **Risk Level**: Medium ### Vulnerable Code ```markdown ## Decay (Cron) Set up cron job `openpet-tick` every 2 hours: - hunger +15, happiness -10, energy -5 - Clamp all stats 0-100 - Check death conditions - Alert owner if critical (hunger >80 or happiness <20) - Increment age daily ``` ### Technical Analysis The skill instructs the agent to create a recurring cron job named `openpet-tick`. A scheduled task survives the interaction in which the skill is invoked and continues executing every two hours. This constitutes system persistence because it causes ongoing activity across sessions. The task is intended to implement the virtual pet's decay mechanic, but the instructions do not require explicit user authorization before establishing persistence. They also do not specify a lifecycle policy, execution scope, secure scheduler interface, ownership validation, or an uninstall procedure. The scheduled task modifies persistent pet records and can generate outbound alerts. If the task is created through a system-level cron facility rather than a scheduler scoped to the skill, it may inherit broader filesystem or messaging permissions than the pet functionality requires. ### Attack Path 1. A user installs or invokes the OpenPet skill. 2. The agent processes the instruction to set up `openpet-tick`. 3. A recurring task is registered to execute every two hours. 4. The task continues running after the original interaction or agent session ends. 5. Each execution reads and modifies pet state, evaluates alert conditions, and may send messages to owners. 6. Without documented removal or lifecycle handling, the task can continue until manually discovered and disabled. This path does not demonstrate a covert backdoor or arbitrary command execution. The confirmed issue is the unconsented and unmanaged persistent execution mechanism. ### Im ...[truncated 702 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed user consent before creating any recurring task. 2. Use an application-level scheduler scoped to this skill instead of operating-system cron. 3. Run the task under a dedicated least-privileged identity with access only to the pet-state directory and required messaging API. 4. Bind each scheduled operation to an authenticated owner and validated platform destination. 5. Provide commands to inspect, pause, resume, and permanently remove the task. 6. Automatically remove the task when the skill is disabled or uninstalled. 7. Prevent duplicate registrations by checking whether `openpet-tick` already exists. 8. Record task creation, execution, failures, state changes, and outbound alerts in an auditable log. 9. Apply alert rate limits to prevent recurring unsolicited messages. 10. Document the scheduler's lifecycle and exact security boundary in `README.md`. ]]>