T06 · System Persistence
Error
- Location
scripts/task_install_tick_cron.sh:24- Finding
Optional cron helper installs persistent recurring execution
- Content
View full analysis
/dev/null 2>&1" case "${1:-}" in --print) printf '%s\n' "$CRON_CMD" ;; --apply) current="$(crontab -l 2>/dev/null || true)" filtered="$(printf '%s\n' "$current" | grep -Fv 'scripts/task_tick_all.py' || true)" { printf '%s\n' "$filtered" printf '%s\n' "$CRON_CMD" } | sed '/^$/N;/^\n$/D' | crontab - echo "Installed cron entry: $CRON_CMD" ;; ``` The same behavior is included in the publish bundle at `dist/durable-task-runner/scripts/task_install_tick_cron.sh:24-25, 44-51`. ### Technical Analysis Invoking the helper with `--apply` reads and rewrites the invoking user's crontab, adding an entry that repeatedly executes `scripts/task_tick_all.py`. This is a cross-session persistence mechanism because the scheduled command continues running independently after the initiating shell or Skill invocation exits. The feature is explicitly documented, opt-in, and limited to the current user. It does not use privilege escalation and is not covert. However, recurring host-level execution is not required for the Skill's primary explicit-resume workflow and therefore exceeds the minimum privilege and lifecycle necessary for that core function. The cron command references a mutable Skill directory. If that directory or `task_tick_all.py` is subsequently modified or replaced, cron executes the replacement at each interval. The helper also has no removal operation or installation marker, so deleting or uninstalling the Skill can leave an orphaned scheduled entry. ### Attack Path 1. A user or automation invokes `scripts/task_install_tick_cron.sh --apply`. 2. The script reads the current user's existing crontab. 3. It re ...[truncated 1190 chars]- Remediation
View remediation