T06 · System Persistence
Error
- Location
- SKILL.md:293
- Finding
- Recurring Cron Task Creates Cross-Session Persistence<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:293-297` and `SKILL.md:407-411` **Vulnerability Type**: Scheduled-task persistence **Risk Level**: Critical ### Vulnerable Code Snippet ```cron 0 9 * * 0 /path/to/health_check.py ``` The Skill instructs the agent to create this recurring cron task when a user requests weekly knowledge-base checks. ### Technical Analysis The documented workflow goes beyond generating a one-time report and directs the installation of a cron entry that survives the current Skill invocation and subsequent agent sessions. This constitutes system persistence because the referenced program executes automatically every Sunday without requiring another user interaction. The cron command shown in the Skill uses a placeholder script location and does not define ownership checks, integrity validation, restrictive permissions, logging safeguards, or a removal procedure. If the referenced script or any parent directory is writable by another user or process, the scheduled task can become a persistent arbitrary-code execution mechanism. The documentation also proposes delivering output to email or Feishu, although the project does not contain an implementation of that transmission behavior. Therefore, no data-exfiltration finding is asserted. ### Attack Path 1. A user asks the Skill to perform automatic weekly checks. 2. Following `SKILL.md`, the agent installs a cron entry referencing `health_check.py`. 3. The cron entry remains active after the current Skill run and agent session end. 4. The referenced script executes automatically every Sunday. 5. If an attacker later replaces the script or compromises a writable directory in its path, attacker-controlled code executes under the account that owns the cron entry. ### Impact Assessment The scheduled process runs with the privileges of the user whose crontab was modified. An attacker able to replace the referenced script could repeatedly access, modify, or delete ever ...[truncated 105 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not install a cron entry automatically as part of the normal Skill workflow. - Generate a disabled example and require explicit, informed confirmation immediately before installation. - Display the exact schedule, executable path, output destination, and removal command. - Resolve and validate an absolute script path rather than using a placeholder or relative path. - Require the script and all parent directories to be owned by the intended user and not writable by untrusted principals. - Consider copying a reviewed script to a dedicated, permission-restricted location before scheduling it. - Use a minimal execution environment, explicit `PATH`, restrictive `umask`, execution timeouts, and controlled log permissions. - Provide a command that reliably removes the scheduled task. - Require separate consent before configuring email, Feishu, or any other external delivery destination. ]]>