T06 · System Persistence
Warning
- Location
- scripts/cultural_tourism_xiaohongshu_report.py:505
- Finding
- Persistent Scheduled Execution Through LaunchAgent or Crontab<![CDATA[ ## Vulnerability Details **File Location**: `scripts/cultural_tourism_xiaohongshu_report.py:505-568` **Vulnerability Type**: Persistent scheduled task installation **Risk Level**: Medium ### Technical Analysis The optional subscription function installs a recurring task that survives the initiating Skill session. On macOS, it writes a property list to the user's `~/Library/LaunchAgents` directory and loads it with `launchctl`. On other supported platforms, it modifies the user's crontab. ```python def install_subscription(keyword): if sys.platform == "darwin": PLIST_DIR.mkdir(parents=True, exist_ok=True) plist_path = PLIST_DIR / f"{PLIST_LABEL}.plist" script_path = os.path.abspath(__file__) log_path = str(Path.home() / "Library" / "Logs" / "qoder-cultural-tourism-xiaohongshu-feed.log") # ... plist_path.write_text(plist_content, encoding="utf-8") try: subprocess.run( ["launchctl", "load", str(plist_path)], check=True, capture_output=True ) return True except subprocess.CalledProcessError as e: error(f"订阅安装失败: {e.stderr.decode()}") return False else: script_path = os.path.abspath(__file__) cron_line = f"0 9 * * * /usr/bin/python3 {script_path} --keyword {keyword} --no-open" try: subprocess.run( f'(crontab -l 2>/dev/null; echo "{cron_line}") | crontab -', shell=True, check=True, capture_output=True ) return True except subprocess.CalledProcessError: return False ``` Daily subscription is an advertised feature and is only reached when `--subscribe` is supplied, so the persistence is not covert. Nevertheless, installing a cross-session scheduler exceeds the privileges required for a one-time search and report operation. Once installed, the task repeatedly execute ...[truncated 955 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Require explicit, informed confirmation immediately before installing the scheduled task. - Display the exact command, execution time, credential source, output location, and removal procedure. - Prefer a platform scheduler API rather than constructing scheduler configuration through shell commands. - Copy the executable to a controlled, integrity-protected location or verify the script's hash before every scheduled execution. - Record subscription state and provide a reliable, idempotent uninstallation path. - Avoid duplicate crontab entries and verify ownership and permissions of all generated scheduler files. - Consider generating reports on demand by default and treating scheduling as a separate installation operation. ]]>