Schedule Task

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:36 AM UTC
• Version: 1.0.0

Overview

This cron scheduling skill does what it claims, but its implementation can overwrite or fail to remove user cron jobs and accepts unsafe scheduled-task text.

Review this carefully before installing. It can create persistent cron jobs that keep running after the session, and the current implementation may overwrite existing cron jobs or fail to remove the last scheduled job. Only use it in a disposable or well-backed-up account unless it is changed to preserve non-skill cron entries, validate task fields, mark its own cron lines, and show confirmations before changing crontab.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/scheduler.py:119

Finding

Unsafe Whole-Crontab Replacement and Failure to Remove the Last Active Task

Content

View full analysis

> {task['log']} 2>&1" if task.get('log') else "" lines.append(f"{task['cron']} {task['command']}{log_redirect}") new_crontab = "\n".join(lines) + "\n" if new_crontab.strip(): proc = subprocess.Popen(['crontab', '-'], stdin=subprocess.PIPE) proc.communicate(input=new_crontab.encode()) ``` ### Technical Analysis `rebuild_crontab()` constructs a new crontab exclusively from tasks recorded in the Skill's private JSON state and passes it to `crontab -`. This replaces the current user's complete crontab rather than modifying only entries owned by the Skill. Consequently, removing, disabling, or enabling a Skill task can silently delete unrelated cron entries created by the user or other applications. The function also skips the `crontab -` operation when no enabled tasks remain because `new_crontab.strip()` is empty. Therefore, disabling or removing the final enabled task updates `tasks.json` but leaves the previously installed cron entry active. Although modifying cron is necessary for the declared scheduling functionality, taking ownership of the entire user crontab exceeds the minimum required privilege and resource scope. The implementation also fails to verify the child process's exit status, allowing stored state and actual cron state to diverge. ### Attack Path 1. A task is added through the Skill, causing its command to be installed in the current user's crontab. 2. The user disables or removes the final enabled task. 3. `rebuild_crontab()` produces only a newlin ...[truncated 1089 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/scheduler.py:82

Finding

Cron Entry Injection Through Unvalidated Command and Log Fields

Content

View full analysis

> {task['log']} 2>&1" if task.get('log') else "" line = f"{task['cron']} {task['command']}{log_redirect}\n" # Write new crontab new_crontab = current + line ``` The same unsafe construction is repeated during rebuilding: ```python log_redirect = f" >> {task['log']} 2>&1" if task.get('log') else "" lines.append(f"{task['cron']} {task['command']}{log_redirect}") ``` ### Technical Analysis The `command` and `log` values are inserted verbatim into crontab configuration text. Neither field is checked for carriage returns, line feeds, NUL characters, or other configuration-breaking content. A newline in either field can terminate the intended cron entry and introduce additional cron jobs or crontab environment directives. The only cron validation performed by the application checks that the expression splits into five tokens; it does not protect the other fields or validate actual cron grammar. The Skill intentionally supports scheduling arbitrary commands, so shell execution of the declared command is part of its functionality. The vulnerability is the ability for one supplied field to alter the structure of the generated crontab and create entries beyond the single task the operation purports to add. ### Attack Path 1. An attacker, untrusted caller, or compromised agent supplies a `--command` or `--log` value containing a newline. 2. The first line completes the expected scheduled task. 3. Text after the newline contains another valid cron expression and attacker-selected command. 4. `add_to_crontab()` concatenates the value into `new_crontab` without validation or encoding. 5. The script submits the resulting multi-line configuration to `crontab -`. 6. The injected task persists an ...[truncated 871 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The rebuild logic replaces the user's entire crontab with entries derived only from this tool's task list. Removing or toggling one task can silently delete unrelated existing cron jobs, causing denial of service, loss of backups, missed security jobs, or operational outages.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents shell-capable, persistent task scheduling behavior but declares no explicit tool scope or permission boundaries. That creates a meaningful security gap because an agent could invoke shell and file-writing behavior without clear least-privilege constraints, increasing the chance of unauthorized command execution or persistence on the host.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description is broad enough to trigger on many ordinary automation or maintenance requests, which increases the likelihood of the skill being selected in contexts the user did not clearly intend. Because this skill enables recurring command execution, overbroad activation can lead to unintended persistence or scheduling of risky system actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation explains how to create recurring jobs but does not warn users that this creates persistent command execution on the system, potentially with ongoing access to files, network resources, or privileged contexts. In a scheduling skill, that omission is especially dangerous because cron jobs continue running after the immediate session and can be abused for persistence, exfiltration, or destructive automation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

This skill intentionally creates persistent scheduled execution by adding entries to the user's crontab. In a scheduling skill that behavior is context-appropriate, but it still represents persistence and becomes dangerous because arbitrary commands can be scheduled and remain active beyond the initiating session.

Content

Scanner excerpt · scripts/scheduler.py (reported line 75)May include surrounding context.

python

def add_to_crontab(task):
    """Add task to system crontab."""
    try:
        # Get current crontab
        result = subprocess.run(['crontab', '-l'], capture_output=True, text=True)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/scheduler.py (reported line 78)May include surrounding context.

python

"""Add task to system crontab."""
    try:
        # Get current crontab
        result = subprocess.run(['crontab', '-l'], capture_output=True, text=True)
        current = result.stdout if result.returncode == 0 else ""
        
        # Add new line

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

Although Popen is used without a shell, the code writes attacker-controlled cron, command, and optional log content directly into the crontab. Newlines or crafted cron payloads can inject additional cron entries or alter execution semantics, creating persistent arbitrary command execution under the current user.

Content

Scanner excerpt · scripts/scheduler.py (reported line 87)May include surrounding context.

python

# Write new crontab
        new_crontab = current + line
        proc = subprocess.Popen(['crontab', '-'], stdin=subprocess.PIPE)
        proc.communicate(input=new_crontab.encode())
        
    except Exception as e:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Task removal immediately triggers a crontab rebuild that can delete unrelated cron entries, yet the user receives only a generic success message and no confirmation or warning. In this context, the missing safety prompt materially increases the chance of accidental destructive changes.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 94% confidence

Finding

This call rewrites the crontab from task data that contains untrusted cron, command, and log fields. If the stored task file is tampered with or malicious input was previously accepted, rebuilding the crontab re-establishes persistent arbitrary scheduled execution and can also clobber unrelated entries.

Content

Scanner excerpt · scripts/scheduler.py (reported line 136)May include surrounding context.

python

new_crontab = "\n".join(lines) + "\n"
        if new_crontab.strip():
            proc = subprocess.Popen(['crontab', '-'], stdin=subprocess.PIPE)
            proc.communicate(input=new_crontab.encode())
    except Exception as e:
        print(f"Warning: Could not rebuild crontab: {e}")

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The log command opens whatever filesystem path is recorded in task metadata without restricting it to a scheduler-controlled directory. If an attacker can create or modify task entries, they can use this feature to read arbitrary files accessible to the current user, expanding the skill from task management into general file disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.