T06 · System Persistence
- Location
SKILL.md:113- Finding
Persistent Scheduled Execution of Unbundled and Unverified Code
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 113-121
Vulnerability Type: Persistent scheduled task executing code outside the audited package
Risk Level: HighVulnerable Code
bash skill-platform cron add \ --name "calendar-daily-scan" \ --cron "0 22 * * *" \ --tz "Asia/Shanghai" \ --session main \ --system-event "CALENDAR_SCAN: 请立即运行 python3 ~/.skill-platform/workspace/skills/calendar-reminder/calendar_reminder.py 并等待完成" \ --description "每晚22:00扫描明天日历并设置提醒"Technical Analysis
The installation instructions register a persistent daily cron task through
skill-platform. At 22:00 each day, the task injects a system event into the main Agent session instructing it to execute:text python3 ~/.skill-platform/workspace/skills/calendar-reminder/calendar_reminder.pyThe audited project contains only
SKILL.md; the referencedcalendar_reminder.pyimplementation is not included. Consequently, the scheduled payload cannot be reviewed, its integrity is not pinned or verified, and the behavior claimed by the documentation cannot be validated from the supplied artifact.This creates a persistent execution channel whose effective payload is determined by the contents of a mutable file outside the reviewed package. If that file is created or replaced after review, the cron task may execute the substituted code in future sessions.
The documented manual verification does not mitigate this issue because it only runs
echo "implementation_ready"and neither checks the referenced script nor verifies its integrity.Attack Path
- A user follows the installation instructions and registers
calendar-daily-scan. - The cron registration persists beyond the current Skill invocation and targets the main Agent session.
- An attacker or another compromised component with write access to the referenced workspace path creates or replaces
calendar_reminder.py.
...[truncated 941 chars]
- A user follows the installation instructions and registers
- Remediation
View remediation
Remediation Suggestions
- Include
calendar_reminder.pyin the Skill package so its complete implementation can be audited before execution. - Execute a package-relative, canonical path rather than a mutable external workspace location.
- Verify the script with a cryptographic hash or signed manifest immediately before scheduled execution, and fail closed on mismatch.
- Require explicit, informed user confirmation before creating the persistent cron task.
- Display the exact schedule, session, command, target file, required permissions, and persistence implications before registration.
- Use a dedicated least-privileged session instead of
--session main. - Restrict write permissions on the installed script and its parent directories.
- Replace the placeholder validation command with checks that confirm the script exists, resolves to the expected canonical path, matches the approved integrity value, and can perform a safe dry run.
- Provide and document an uninstall command that removes the task, such as the appropriate
skill-platform crondeletion operation. - Avoid instruction-based system events where possible; configure the scheduler to invoke a fixed, verified executable directly with a constrained environment.
- Include