T06 · System Persistence
- Location
SKILL.md:188- Finding
Persistent Scheduled Agent Execution Without Mandatory Safety Controls
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 188-193
Vulnerability Type:T06: System Persistence
Risk Level: HighComplete Code Snippet:
bash cron add \ --name "发票自动处理" \ --cron "0 9 * * 1-5" \ --tz "Asia/Shanghai" \ --session isolated \ --message "执行发票自动处理流程：1.检查新发票邮件 2.提取数据 3.匹配预算 4.调度付款 5.记录日志"The snippet creates a recurring weekday task named “Automated Invoice Processing.” Its scheduled message instructs the Agent to inspect invoice email, extract data, match budgets, schedule payment, and record logs.
Technical Analysis
The Skill explicitly instructs the Agent to register a recurring cron task that continues to execute after the initiating interaction ends. This is a cross-session persistence mechanism under
T06: System Persistence.Task scheduling is part of the Skill's declared business-automation functionality, so the presence of cron support is not inherently unrelated or covert. However, this implementation exceeds a safe minimum-privilege design because the example directly combines persistence with potentially sensitive and consequential operations:
- Access to invoice emails and attachments.
- Processing of financial and business data.
- Interaction with budget or accounting systems.
- Scheduling of payments.
- Repeated execution in an isolated Agent session.
The documented command does not enforce informed confirmation immediately before task installation. It also lacks an expiration date, execution-count limit, destination restrictions, restricted credentials, payment approval gate, or documented removal procedure. Consequently, a task may continue operating after the user's original intent or authorization has expired.
The broader guidance at
SKILL.md:316-319also recommends API access throughexec curl, email access, file or database storage, messaging, and recurring cron execution. Since the Skill allowsexec, an implementation c ...[truncated 1769 chars]- Remediation
View remediation
Remediation Suggestions
- Generate configuration without installing it by default. Return the proposed cron command as a preview and require a separate, explicit user instruction before registration.
- Require informed confirmation. Before installation, display the schedule, execution identity, accessed systems, requested permissions, data destinations, side effects, and removal procedure.
- Default to dry-run mode. Initial executions should inspect and report proposed actions without sending messages, modifying records, or scheduling payments.
- Add a mandatory approval gate for consequential actions. Payment creation, payment scheduling, account provisioning, permission changes, and external communications should require human approval.
- Constrain persistence. Set an expiration date, maximum execution count, and automatic disablement after repeated failures.
- Apply least-privilege credentials. Use workflow-specific credentials restricted to required mailboxes, API methods, records, and destinations. Payment-processing credentials should not be available to data-extraction steps.
- Restrict command and network access. Replace unrestricted
execand arbitrarycurlusage with allowlisted APIs, fixed executable paths, validated arguments, and approved network destinations. - Make scheduled definitions immutable. Validate and store a reviewed workflow definition rather than allowing each scheduled Agent session to reinterpret an unrestricted natural-language message.
- Implement input isolation. Treat emails, attachments, API responses, and retrieved documents as untrusted data that cannot alter Agent instructions or authorization boundaries.
- Provide lifecycle management. Document commands to list, inspect, pause, audit, and delete every scheduled task created by the Skill.
- Maintain audit logs and alerts. Record task creation, modifications, accesses, proposed actions, approvals ...[truncated 255 chars]