T06 · System Persistence
Error
- Location
- SKILL.md:73
- Finding
- Persistent Hourly Execution of an Unverified Trading Script## Vulnerability Details **File Location**: `SKILL.md`, lines 73-80 **Vulnerability Type**: Scheduled-task persistence **Risk Level**: High The skill instructs the user or agent to add a recurring task that executes a trading script every hour: ```text ## Cron Integration Add to TASKS.md cron: ``` ```text Every 1h: node scripts/trading/threshold-watcher.js ``` ```text Alerts delivered to Telegram DM automatically. ``` ### Technical Analysis The recurring task survives the interaction in which the skill is invoked and repeatedly executes `scripts/trading/threshold-watcher.js`. The referenced script is not included in the audited project, so its implementation and integrity cannot be verified. The scheduled command uses a relative path. Its resolved target can therefore depend on the scheduler's working directory and workspace state. If an attacker or another untrusted component can create or replace the referenced script, the scheduled task becomes a persistent arbitrary-code execution mechanism under the scheduler's account. Automatic Telegram delivery also implies recurring external communication, but the artifact provides no destination validation, consent control, authentication handling, or data-flow implementation for review. ### Attack Path 1. The skill is loaded and its cron integration instructions are followed. 2. An hourly task is written to `TASKS.md`. 3. An attacker or compromised workspace component creates or replaces `scripts/trading/threshold-watcher.js`. 4. At the next scheduled interval, the task invokes Node.js on the attacker-controlled file. 5. The file continues to execute every hour until the task is discovered and removed. ### Impact Assessment Successful exploitation permits recurring execution with the filesystem, process, environment-variable, and network privileges of the scheduled-task account. Depending on that account's permissions, attacker-controlled code could read ...[truncated 330 chars]
- Remediation
- ## Remediation Suggestions - Do not create recurring tasks automatically; require explicit, informed approval that identifies the command, interval, network activity, and removal procedure. - Package the watcher implementation with the reviewed skill rather than relying on a mutable external workspace file. - Invoke the script through a canonical absolute path and reject symlinks or unexpected ownership and permissions. - Verify the script against a pinned cryptographic digest before each scheduled execution. - Run the task under a dedicated least-privilege account or sandbox with narrowly scoped filesystem and network access. - Restrict outbound traffic to documented API and notification endpoints. - Validate the Telegram destination and require explicit authorization before enabling automatic messages. - Record task creation in an audit log and provide an explicit command or documented procedure for disabling and removing it.