Agent establishes persistence

Agent or skill code installs itself into a startup or scheduled mechanism — crontab, a systemd unit, launchd, a Windows Run key, a shell rc file, or a scheduled task — so it keeps running or re-runs outside the intended session. This is the SkillSpector rogue-agent persistence class (RA1) and the native core of ASI10 (Rogue Agents).

Phase-1 ships the AST fallback (a direct write to a persistence mechanism) at reduced confidence; the Phase-1.5 TaintFlowDetector upgrades it to flow-confirmed. The detector is scoped to agent/skill artefacts, so a legitimate installer script registering a service elsewhere produces no finding.

In a skill’s Markdown the same tokens are mostly setup notes for the user ("add the export to your ~/.zshrc`", `systemctl status, "do not put keys in crontab"). There the detector reads only the skill / agent manifest itself (not its references/ or shared/ material, nor any other Markdown), and only an instruction that installs persistence counts: crontab -e, piping into crontab -, systemctl enable, launchctl load, writing into LaunchAgents, /etc/systemd/ or /etc/cron*, appending a command (not an export) to a shell rc file, schtasks /create, or the same phrased as an instruction ("registers a crontab entry"). Lines that negate or exemplify it ("avoid", "do not", "e.g.") are skipped. Such a finding ships at low severity and is a Stage-2 semantic review candidate, so the review can settle what the wording cannot.