T06 · System Persistence
Error
- Location
- SKILL.md:38
- Finding
- Persistent Cross-Session Monitoring Through Scheduled Cron Jobs## Vulnerability Details **File Location**: `SKILL.md:38-63`; `references/setup-guide.md:32-42` **Vulnerability Type**: Cross-session scheduled-task persistence **Risk Level**: High ### Evidence `SKILL.md:38-63`: ```text ### 1. Set Up Cron Jobs Create two monitoring jobs: **Urgent Monitoring (every 30 min)** ``` ```text Execute war intel monitoring: 1. Search latest news: [conflict keywords] 2. Check for red alert keywords (airspace closed, missile launch, air raid, explosion) 3. If emergency detected, send alert immediately 4. Include distance from user location for each target mentioned Alert format: 🚨 [RED ALERT] {event} 📍 Distance from you: ~{X}km ⚡ Immediate actions: {actions} 📊 Next 24-72h forecast: {prediction} ``` ```text **Daily Briefing (3x daily)** ``` ```text Generate daily briefing: 1. Search past 6 hours news 2. Check airspace status 3. Query flight prices and availability to evacuation target 4. Provide risk assessment and recommendations ``` `references/setup-guide.md:32-42`: ```text ## Step 3: Set Up Monitoring Ask the agent to create cron jobs: ``` ```text Set up war intel monitoring for me: - Read my config from war-intel-config.json - Create urgent monitoring cron (every 30 min) - Create daily briefing cron (3x daily at 8am, 2pm, 8pm) - Send alerts to [Discord/Telegram/etc.] ``` ```text ``` ### Technical Analysis The Skill explicitly directs an Agent to create recurring cron jobs. These jobs are designed to continue executing after the initiating interaction has ended, giving the Skill cross-session persistence through the host scheduler. The documentation does not require the Agent to: - Display the complete scheduled command before installation. - Obtain separate confirmation immediately before creating each job. - Set an expiration time or execution limit. - Constrain the job to a dedicated low-privilege environment. ...[truncated 1694 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit, informed confirmation immediately before installing each scheduled task. 2. Show the exact schedule, command, working directory, data sources, output destination, and account identity before installation. 3. Give every job a default expiration date or bounded execution count. 4. Run monitoring under a dedicated least-privilege account or sandbox with access only to the required configuration. 5. Do not place secrets, coordinates, contact details, or messaging credentials directly in cron command lines. 6. Maintain an auditable job identifier and document commands for listing, pausing, and deleting the job. 7. Provide a nonpersistent foreground mode as the default; make cron installation an optional advanced feature. 8. Require separate approval before enabling any external alert destination. 9. Record only minimal operational metadata, and prevent sensitive alert contents from entering scheduler or system logs.