T06 · System Persistence
- Location
SKILL.md:156- Finding
Persistent Scheduled Execution in the Agent's Main Session
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 156–162
Vulnerability Type: Persistent scheduled task with recurring Agent-directed code execution
Risk Level: HighVulnerable Code
bash skill-platform cron add \ --name "calendar-daily-scan" \ --cron "0 22 * * *" \ --tz "Asia/Shanghai" \ --session main \ --system-event "CALENDAR_SCAN: Please immediately run python3 ~/.skill-platform/workspace/skills/calendar-reminder/calendar_reminder.py and wait for completion" \ --description "Scan tomorrow's calendar every night at 22:00 and configure reminders"The original system-event and description strings are written in Chinese in the audited file; they are translated above to comply with the report's English-only requirement.
Technical Analysis
The installation instructions create a persistent cron entry that targets the Agent's
mainsession and survives beyond the current Skill run. At 22:00 every day, the scheduler injects a system event instructing the Agent to execute a Python file from the user's writable workspace.The persistence is explicitly documented at line 100:
After registration, the task remains persistent in skill-platform and continues to trigger even after the Agent restarts.
This design creates a recurring execution boundary around
calendar_reminder.py. Because that script is not included in the audited artifact, its integrity and behavior cannot be verified. If the file is added or replaced after review, the persistent task can repeatedly execute its new contents under the Agent's effective privileges.Attack Path
- A user follows the Skill instructions and deploys a file named
calendar_reminder.pyinto the specified workspace. - The user runs the documented
skill-platform cron addcommand. - The platform stores a persistent scheduled task associated with the Agent's
mainsession. - An attacker or compromised process with writ ...[truncated 1321 chars]
- A user follows the Skill instructions and deploys a file named
- Remediation
View remediation
Remediation Suggestions
- Do not create scheduled tasks automatically. Require explicit, informed user approval immediately before registration.
- Avoid targeting the Agent's
mainsession. Use a dedicated, least-privilege session that has access only to the required calendar and notification functions. - Package the executed script with the Skill so its exact contents can be reviewed during installation.
- Store the executable in an administrator-controlled, non-user-writable location with restrictive ownership and permissions.
- Pin and verify the script's cryptographic hash before every scheduled execution. Refuse execution if verification fails.
- Replace the free-form system event with a narrowly scoped platform-native job that invokes a fixed, validated executable and fixed arguments.
- Restrict the job's filesystem, network, environment-variable, and credential access to the minimum required.
- Provide exact commands for pausing and permanently deleting the scheduled task.
- Record task creation, modification, execution, and deletion in an auditable log.
- Require reauthorization whenever the executable path, script hash, target session, calendar account, or notification destination changes.