Check the home directory of flag03 and take note of the files there.
There is a crontab that is called every couple of minutes.
The writable.sh script is called by crontab every minute (I never saw it in /etc/ however). The script reads each file in the sub directory writable.d, and executes it.
We create a script that will call getflag and pipe the response to a file in the /tmp folder. The cron job runs under the user context of flag03.