T06 · System Persistence
- Location
SKILL.md:58- Finding
Unattended Daily Outreach Through a Persistent Scheduled Task
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:58-60; corroborating configuration atskill.json:17-27
Vulnerability Type: T06: System Persistence
Risk Level: HighVulnerable code in
SKILL.md:markdown ### 📅 Automatic Triggers - **Daily Discovery**: Runs at 9 AM local time via cron. - **Outreach Loop**: Enforces connection budgets to protect your account.Corroborating configuration in
skill.json:json "triggers": [ "Start my PH outreach", "Set up wingman", "Scrape ProductHunt streaks", "How many connections did wingman send today?", "Check my launch outreach status", "Enrich new prospects", "Pause wingman", "cron" ], "schedule": "0 9 * * *",Technical Analysis
The skill declares a daily cron schedule that causes its discovery and outreach behavior to continue across interactive sessions. Scheduled execution is a persistence mechanism because activity can be initiated every day without a fresh user command or renewed authorization.
This is particularly sensitive because the documented workflow also uses a retained local LinkedIn browser session and performs profile discovery, enrichment, and engagement. Consequently, a persistent scheduler could repeatedly invoke account-facing automation after the user has stopped interacting with the skill.
The audited package contains only
SKILL.mdandskill.json. The referencedserver/,server/main.py,server/linkedin_agent.py, andsetup.shcomponents are absent, so the exact cron installation mechanism, executed command, scheduler ownership, removal behavior, and runtime safeguards could not be verified. The finding is therefore based on the explicit persistent behavior declared by the packaged documentation and schedule configuration; it does not establish that an operating-system crontab is installed directly.Attack Path
- A user installs or enables the skill and supplies the ...[truncated 1340 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove automatic schedule registration from the default installation path and require explicit, informed opt-in before creating any recurring task.
- Display the exact schedule, executable command, working directory, environment access, and anticipated account actions before obtaining consent.
- Require a separate confirmation for unattended LinkedIn or external-account activity; enabling discovery should not implicitly enable outreach.
- Provide documented commands to list, pause, and permanently remove all scheduler entries and background services created by the skill.
- Automatically remove scheduled tasks during uninstallation and verify that no orphaned cron entries or background processes remain.
- Add an expiration date or maximum run count so authorization does not persist indefinitely.
- Require confirmation immediately before sending messages or connection requests, even when discovery is scheduled.
- Use least-privilege execution under the installing user and prohibit elevated or system-wide scheduler installation.
- Record an auditable log of scheduler creation, each scheduled invocation, external-account actions, and scheduler deletion.
- Include the referenced runtime files in the audited package, pin their integrity with cryptographic hashes, and document precisely whether the schedule is managed by the host platform or the operating-system crontab.