T06 · System Persistence
Warning
- Location
assets/daily_report.py:1077- Finding
Opt-in Installation of a Persistent Scheduled Task
- Content
View full analysis
/dev/null; echo "{cron_line}") | crontab -', shell=True, check=True, capture_output=True ) info("订阅成功! 每天 09:00 自动生成快手爆款日报 (crontab)") ``` The macOS implementation similarly writes a LaunchAgent property list and loads it with `launchctl`. ### Technical Analysis The `--subscribe` operation modifies the user's crontab so that the script executes every day at 09:00. This behavior survives completion of the current Skill run and future login sessions. The persistence is documented in `SKILL.md` and requires the user to select `--subscribe`, so it is not covert. Nevertheless, scheduled execution is not required for one-time report generation and exceeds the minimum privileges needed for the Skill's core report-generation function. Once installed, subsequent report generation and associated network access occur without renewed per-run approval. The scheduled task executes the script by its existing filesystem path. If that file or a parent directory is writable by another account or compromised process, replacing the script would turn the scheduled task into a recurring arbitrary-code execution mechanism. ### Attack Path 1. The user runs `daily_report.py --subscribe`. 2. The Skill modifies the user's crontab or installs a macOS LaunchAgent. 3. The scheduled task persists after the current execution ends. 4. An attacker who can replace or modify the referenced script changes its contents. 5. At the next scheduled time, the modified code executes with the subscribing user's privileges. ### Impact Assessment The scheduled task runs with the privileges of the ...[truncated 373 chars]- Remediation
View remediation