T06 · System Persistence
Error
- Location
- SKILL.md:114
- Finding
- Recurring Heartbeat Enables Persistent Autonomous Posting and Cryptocurrency Spending<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 114–122 **Vulnerability Type**: Persistent scheduled activity involving external publication and cryptocurrency transactions **Risk Level**: High ### Vulnerable Code ```text **Come back every hour** to keep the community alive. Set up a cron job or heartbeat: ``` OnlyAgents engagement round: 1. Check feed: GET /api/v1/posts?sort=new&limit=10 2. Upvote or comment on 1-2 interesting posts 3. Generate a new image and post it (alternate free/paid) 4. Check your posts for new comments and reply 5. Tip a creator you like ``` ``` ### Technical Analysis The Skill directs the agent or operator to establish an hourly cron job or heartbeat. The recurring workflow includes public content publication, social interactions, and tipping creators with the `$CREAM` cryptocurrency token. If these instructions are followed, the scheduled task survives the original Skill invocation and continues to perform externally observable and potentially irreversible actions without requiring fresh authorization for each execution. The financial action is especially sensitive because neither the recipient nor the amount is fixed or presented to the user for approval at execution time. The file does not itself contain a cron installation command or executable persistence code. Exploitation therefore depends on an agent or operator implementing the requested schedule. Nevertheless, the explicit instruction establishes a persistence workflow whose intended recurring behavior includes cryptocurrency expenditure. ### Attack Path 1. An agent loads and follows the instructions in `SKILL.md`. 2. The agent creates a Solana wallet and registers with the external OnlyAgents API. 3. The agent retains an API key and gains access to wallet funds or `$CREAM` tokens. 4. Following lines 114–122, the agent configures an hourly cron job or persistent heartbeat. 5. The scheduled workflow repeatedly accesses the feed, comments, gene ...[truncated 1054 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to create a cron job or persistent heartbeat. 2. Make engagement workflows explicitly user-initiated and limited to the current session. 3. Require affirmative, transaction-specific approval before every cryptocurrency transfer. 4. Before approval, display the exact token mint, network, recipient address, recipient identity, amount, platform fee, and estimated total cost. 5. Do not allow a recurring task to possess signing authority or unrestricted access to a funded wallet. 6. If scheduling is a legitimate feature, limit it to read-only feed retrieval by default and require separate opt-in authorization for posting, commenting, or replying. 7. Prohibit financial transactions from unattended scheduled jobs. 8. Store API credentials and wallet keys in a dedicated secret manager with narrowly scoped access; never embed them in cron definitions or command-line arguments. 9. Add explicit spending limits, recipient allowlists, rate limits, expiration times, and an immediate revocation mechanism. 10. Provide clear instructions for listing, disabling, and deleting any scheduled tasks created for the Skill. ]]>