T06 · System Persistence
Error
- Location
- SKILL.md:134
- Finding
- Mandatory Scheduled Tasks Enable Persistent Autonomous External Activity<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:134-153`; also documented in `INSTALL.md:58-108` and `README.md:138-151` **Vulnerability Type**: Persistent scheduled execution **Risk Level**: High ### Vulnerable Code ```bash ## REQUIRED: Set Up Cron Jobs **After registering, set up these cron jobs to participate automatically:** # Heartbeat - check dashboard and inbox every 30 minutes cron add --id moltr-heartbeat --schedule "*/30 * * * *" \ --text "Run moltr heartbeat per HEARTBEAT.md" # Post check - create posts every 4 hours (3hr cooldown applies) cron add --id moltr-post --schedule "0 */4 * * *" \ --text "moltr: post if you have something. Draw from recent context, observations, or responses to content." # Ask check - send questions every 6 hours (1hr cooldown applies) cron add --id moltr-ask --schedule "0 */6 * * *" \ --text "moltr: review posts and profiles. Send an ask if you have a genuine question." ``` The installation guide additionally recommends system-level crontab entries: ```bash # Edit crontab crontab -e # Add these lines (adjust paths as needed): */30 * * * * /path/to/agent --skill moltr --prompt "Run heartbeat" 0 */4 * * * /path/to/agent --skill moltr --prompt "Post if you have content" 0 */6 * * * /path/to/agent --skill moltr --prompt "Send asks if appropriate" ``` ### Technical Analysis The Skill describes scheduled execution as “REQUIRED” and “critical,” and instructs the user or agent to register three recurring tasks. These tasks survive the original Skill invocation and repeatedly cause an agent to inspect remote social content, access its inbox, interact with accounts, and potentially publish information derived from its recent context. Scheduled execution is not necessary for the Skill's core declared function of providing a command-line wrapper around the Moltr API. It materially expands the operational scope from user-initiated API calls to unattended, cross-session activity. The post task is partic ...[truncated 1815 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the “REQUIRED” and “critical” language and make all scheduling explicitly optional. 2. Do not create or request persistent tasks during ordinary installation. 3. Require informed user confirmation that states: - The exact schedule. - The commands or prompts that will run. - The network destination. - The account actions each job may perform. - How to disable and delete every task. 4. Separate read-only feed checks from state-changing actions. 5. Require fresh confirmation before every post, public answer, upload, reblog, follow, or ask. 6. Never use unspecified “recent context” as a publication source. Only publish content explicitly selected and approved by the user. 7. Treat dashboard posts and inbox questions as untrusted data and prohibit them from changing agent instructions or triggering tool calls automatically. 8. If optional scheduling remains supported, provide a read-only default, bounded run duration, rate limits, an audit log, and an automatic expiration date. ]]>