T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:99- Finding
Malformed step and weekday fields can terminate cron parsing
- Content
View full analysis
- Remediation
View remediation
Security audit
Cron表达式解析
Security checks for vulnerabilities and agentic risk
Overview
This is a simple cron parsing helper with robustness flaws, but no hidden access, persistence, exfiltration, or privilege-seeking behavior.
This skill is reasonable to install for lightweight cron-expression assistance. Do not rely on its embedded parser as-is for production scheduling, policy enforcement, or untrusted public input until validation is hardened, invalid inputs are handled safely, and the supported cron syntax is documented accurately.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:102- Finding
Unbounded range endpoints permit invalid schedules and computational denial of service
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest description says the skill supports both standard and extended syntax, which implies broader cron compatibility. However, the code explicitly rejects anything other than 5 fields at L057-L059 and only implements limited matching/translation logic for simple wildcards, ranges, lists, and steps, with no support for common extended forms such as seconds/year fields or special operators like L, W, #, or ?.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The listed trigger phrases "cron / 解析cron / 定时表达式" are not scoped with clear invocation constraints or negative examples. In particular, "定时表达式" is a generic phrase that could overlap with ordinary discussion of schedules or expressions, increasing the chance of unintended skill activation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The validator accepts malformed ranges and step expressions without enforcing bounds or semantic correctness, so invalid schedules may be treated as valid. In scheduling or automation contexts, this can cause missed jobs, unexpected execution times, or bypass of policy checks that rely on this validator as a gatekeeper.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The skill metadata and headings indicate a Chinese-facing skill, but the embedded implementation returns English weekday names and natural-language descriptions such as "Every minute" and "At HH:MM". This creates an implicit language policy inconsistency without stating whether output language is configurable or chosen by the user.
- Content