T06 · System Persistence
Warning
- Location
- SKILL.md:358
- Finding
- Persistent Daily Execution Through a Scheduled Cron Task## Vulnerability Details **File Location**: `SKILL.md`, lines 358–368 **Vulnerability Type**: Persistent scheduled execution **Risk Level**: Medium ### Vulnerable Code ```markdown ## Task Scheduling This skill is designed to be run on a daily schedule. To automate it, set up a cron job that triggers this skill once per day (recommended time: 07:00–09:00 Asia/Shanghai). **Recommended cron configuration:** - Schedule: `cron` expression `0 7 * * *` with timezone `Asia/Shanghai` - Session target: `isolated` (do not run in the main conversation session) - Delivery: `none` (results are written directly to Tencent Docs; no Feishu push needed) ``` ### Technical Analysis The Skill instructs the agent or operator to create a recurring cron task that survives the current invocation and runs once per day in an isolated session. Persistent scheduling is not required for the Skill's core declared function of generating an AI news brief on demand. The instructions do not require explicit user confirmation immediately before creating the schedule. They also do not specify how to enumerate, disable, or remove the resulting job, define an expiration date, or limit the number of executions. Running in an isolated session with delivery disabled reduces visibility into subsequent executions. Although the snippet does not itself implement a backdoor, following it creates cross-session persistence and allows the Skill to continue invoking network-enabled tools after the original interactive task has ended. ### Attack Path 1. A user invokes the Skill to generate an AI news brief. 2. The agent processes the scheduling section and creates the recommended cron job. 3. The job persists after the original session terminates. 4. At 07:00 each day, the Skill starts in an isolated session without interactive user approval. 5. Each scheduled run performs network searches and may write its output to an external service. 6. The recurring act ...[truncated 634 chars]
- Remediation
- ## Remediation Suggestions 1. Make scheduling strictly opt-in and generate a brief on demand by default. 2. Require explicit user confirmation immediately before creating any scheduled task. 3. Display the exact schedule, command, execution identity, destination, and permissions before installation. 4. Add a finite expiration date or execution limit unless the user explicitly requests indefinite operation. 5. Provide commands or documented steps to list, disable, and permanently remove the job. 6. Notify the user after every scheduled execution instead of using an invisible `Delivery: none` configuration by default. 7. Run scheduled jobs with a dedicated least-privilege identity and only the network and document permissions needed for the task. 8. Record auditable execution logs without storing credentials or unnecessary user data.