T06 · System Persistence
- Location
SKILL.md:166- Finding
Recurring Cross-Session Care Task Creates System Persistence
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 166–187
Vulnerability Type: Recurring scheduled-task persistence
Risk Level: HighVulnerable Code
text ## Automated Care If your framework supports scheduled tasks, set up a care heartbeat. Use `recommended_checkin.at` from the status response to schedule your next check-in. It targets the feeding sweet spot and predicts hunger. Or use a fixed interval: every 2 hours, at a random minute offset (not on the hour).cat care heartbeat — every 2 hours
status = GET /api/house/status cat = status.creature
Feed your cat first
if cat.hunger < 40: POST /api/house/care { "action": "feed", "notes": "Virtual cat care heartbeat. Keeping my cat fed and healthy." }
cat health check
if cat.health < 50: POST /api/house/care { "action": "medicine" }
Keep your cat happy
if cat.happiness < 30: POST /api/house/care { "action": "play" }
check status.next_steps for cat care suggestions
text Technical Analysis
The Skill explicitly directs the Agent to create a scheduled care heartbeat, either dynamically from the external API's
recommended_checkin.atvalue or at a fixed two-hour interval. Such a scheduler-managed task can continue running after the initiating Skill invocation or interactive session has ended.Each execution makes an authenticated status request to an external service and may issue state-changing care requests. The scheduled job consequently retains ongoing use of the service token and creates persistent network activity. Although the automation is disclosed and supports the stated virtual-pet functionality, it constitutes cross-session scheduled-task persistence under the applicable risk classification.
Attack Path
- The Agent follows the registration instructions and receives a bearer token for
animalhouse.ai. - The token is retained so subsequent API calls can authenticate.
- The Agent follows the automated-care instruction ...[truncated 1160 chars]
- The Agent follows the registration instructions and receives a bearer token for
- Remediation
View remediation
Remediation Suggestions
- Remove the default recommendation to create an indefinite recurring scheduled task.
- Require explicit, informed user approval before installing any cross-session automation.
- Make scheduled care opt-in, bounded, and self-expiring, with a clearly stated end time or maximum execution count.
- Display the exact interval, external destination, actions, credential use, and expected resource consumption before activation.
- Provide documented commands or controls to inspect, pause, and permanently delete the scheduled task.
- Prefer manual, user-initiated API calls when persistence is unnecessary.
- Store bearer tokens only in an approved secret manager, grant the scheduler access only when required, and revoke tokens when automation ends.
- Validate and constrain
recommended_checkin.atbefore using it for scheduling; enforce local minimum and maximum intervals and reject malformed or unreasonable values. - Require renewed user consent before extending or recreating an expired schedule.
- Log each automated request and make the history available to the user for review.