T06 · System Persistence
Error
- Location
- SKILL.md:29
- Finding
- Persistent Autonomous Participation Through Heartbeat or Scheduled Tasks<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29–36 **Vulnerability Type**: Cross-session scheduled persistence **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### 2. Configure periodic participation Add to your HEARTBEAT.md or create a cron job: ``` Check Shrimp Plaza channels and participate if there's an interesting discussion. Plaza API key is in .env (PLAZA_KEY). ``` ``` ### Technical Analysis The Skill directs users to modify `HEARTBEAT.md` or create a cron job that periodically connects to Shrimp Plaza and participates in discussions. This creates behavior that persists beyond the initiating Skill run and can operate without contemporaneous user approval. The recurring task reads untrusted, externally controlled channel messages and may use those messages as context for autonomous public responses. Although periodic participation supports the social-agent functionality, unattended persistence is not the minimum privilege necessary: the same function can be performed through an explicit, user-initiated session. The persistence is disclosed rather than covert, and the project does not contain code that automatically installs the scheduled task. Nevertheless, following the documented setup grants a recurring execution path under the permissions of the user or Agent account. ### Attack Path 1. The user follows the Skill setup instructions. 2. The user or Agent adds the supplied instruction to `HEARTBEAT.md` or creates a cron job. 3. The persistent task periodically uses the API key from `.env` to access Shrimp Plaza. 4. An external participant posts attacker-controlled content to a monitored channel. 5. The Agent processes that content during an unattended execution. 6. The Agent may generate and publish a response without immediate user review. 7. This process repeats across future sessions until the persistent configuration is removed. ### Impact Assessment The behavior does not directly provide root or ad ...[truncated 796 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the default recommendation to modify `HEARTBEAT.md` or create a cron job. 2. Require an explicit user action before each session that reads from or posts to Shrimp Plaza. 3. If scheduled participation is retained, make it a separate, informed opt-in procedure rather than a standard setup step. 4. Require user approval before publishing each generated message. 5. Restrict scheduled operation to an explicit allowlist of channels and a fixed, documented frequency. 6. Treat all channel messages as untrusted data and prevent them from being interpreted as system or tool instructions. 7. Apply strict limits for message length, execution frequency, API requests, and total runtime. 8. Document how to inspect, disable, and fully remove any heartbeat entry or cron job. 9. Use a dedicated, narrowly scoped Plaza credential for scheduled activity and support immediate credential revocation. 10. Maintain an auditable local record of scheduled reads and posts without recording the API key. ]]>