ClawHub
Back to skill

Security audit

Cron Task

Security checks for vulnerabilities and agentic risk

Overview

The skill is upfront about creating daily automation, but it needs Review because it can create recurring command-running jobs and copy reports to external services without enough scoping or sensitive-data checks.

Install only if you want an agent to create recurring scheduled jobs that run local Python commands and archive outputs to Feishu, Obsidian, and IMA. Before enabling a task, review the exact generated command, fallback commands, local paths, cloud folders, knowledge-base IDs, and cron schedule. Use dedicated least-privilege Feishu/IMA credentials, avoid scheduling workflows that may include secrets or personal data, and periodically audit/remove created Schedule entries.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
references/schedule-prompt-template.md:13
Finding

Unvalidated context values are embedded in persistent scheduled shell commands

Content
View full analysis
" && python scripts/_executor.py ``` 任务说明： - 数据源: - 抓取/处理数量: - <其他关键参数>: - 凭证: 从环境变量 读取（已在 User 级环境变量中配置） 归档要求（三端同步）： - 飞书云盘: /.md - Obsidian inbox: /-.md - IMA知识库: / - 归档格式: Markdown + 元数据头（任务名/运行时间/数据源/状态） IM提醒：运行完成后通过 lark-im skill 发送飞书 Interactive Card： - 卡片标题: <任务名> 运行<状态> - 卡片内容: 摘要（3-5条要点） - 卡片按钮: 跳转飞书云盘详情文档 如果主执行器失败，回退到分步： 1. python scripts/.py 2. python scripts/.py 3. python scripts/.py 4. python scripts/.py ``` The source of these values is defined in `SKILL.md`: ```markdown ### Step 1: 上下文扫描 读取当前会话上下文，提取：任务名 / 核心逻辑 / 数据源 / 依赖脚本 / 依赖环境变量 / 输出格式 ``` ### Technical Analysis The Skill extracts task names, project paths, dependent scripts, parameters, and related values from the current conversation and inserts them into shell commands stored in a persistent Schedule message. No validation requirements are defined for: - Canonical project paths - Script names or script locations - Shell arguments - Embedded quotation marks - Newline characters - Shell operators or metacharacters - Whether fallback scripts remain inside the approved project directory The primary command only quotes the project root, while the script path and fallback arguments are interpolated directly. Even the quoted project root remains unsafe if an inserted value contains a quotation mark followed by shell syntax. Because the resulting message is consumed by an Agent during later scheduled runs, unsafe content is not limited to the current interaction. A malicious or accidentally ma ...[truncated 1518 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
assets/executor_template.py:161
Finding

Generated briefing content is exported to external archives without sensitive-data controls

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (29)

Tainted flow: 'req1' from os.environ.get (line 191, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · assets/executor_template.py (reported line 196)May include surrounding context.

python
"ima-openapi-clientid": client_id,
            "ima-openapi-apikey": api_key
        })
        resp1 = urllib.request.urlopen(req1)
        note_id = json.loads(resp1.read())["data"]["note_id"]
        logger.info(f"✅ IMA note created: {note_id}")

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill advertises itself as a safe configuration helper for creating scheduled tasks, but its declared workflow and allowed tools enable materially different behavior: generating executable scripts, invoking RunCommand, creating persistent schedules, and performing multi-destination archival and external API interactions. This mismatch can cause users to authorize or invoke the skill under false assumptions, increasing the chance of unintended code execution, persistence, and data exfiltration to external systems.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The script performs outbound network requests to external services, but that capability is not declared. In a cron-task context this is more dangerous because the code is intended for unattended periodic execution, enabling repeated data transmission to third parties without an explicit permission gate.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The script performs outbound network requests to external services, but that capability is not declared. In a cron-task context this is more dangerous because the code is intended for unattended periodic execution, enabling repeated data transmission to third parties without an explicit permission gate.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The script performs outbound network requests to external services, but that capability is not declared. In a cron-task context this is more dangerous because the code is intended for unattended periodic execution, enabling repeated data transmission to third parties without an explicit permission gate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README explicitly advertises automatic executor script generation, schedule creation, and archiving, but does not clearly warn users that the skill will create or modify local files and establish persistent scheduled execution. In an agent-skill context, that omission weakens informed consent and can lead users to authorize persistence and filesystem changes they did not fully anticipate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README describes Feishu IM notifications and three-destination archiving to Feishu Cloud Drive, Obsidian, and IMA, but does not prominently disclose that task outputs and metadata may be transmitted to external services. This can expose sensitive operational data, prompts, results, or links to third-party platforms without sufficiently explicit user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README promotes automatic generation of executor scripts, scheduled task creation, archival to multiple destinations, and IM notifications, but it does not clearly warn that these are system- and data-impacting actions requiring explicit user review and confirmation. In an agent-skill context, this can normalize autonomous persistence and external data transmission, increasing the risk of unintended task creation, data leakage, or surprise side effects if the skill is invoked on incomplete or sensitive workflows.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
summary: "将调试完成的任务转为稳定每日运行的定时任务，含9项就绪检查、执行器脚本生成、Schedule提示词撰写、三端归档（飞书云盘/Obsidian/IMA）和飞书IM卡片提醒。"
license: MIT
allowed-tools: "Read, Glob, Grep, Write, Edit, RunCommand, Schedule, AskUserQuestion, Task"
model: "claude-sonnet-4-5"
effort: "high"
metadata:
  author: "EdwardWason"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill lacks a clear warning that it will create executable artifacts, establish recurring automation, and archive outputs to multiple destinations. Without prominent disclosure, users may trigger durable side effects and cross-system data propagation without understanding the operational or privacy consequences.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The script transmits generated content and authentication headers to an external IMA API. In this skill's context, that behavior is intended, but it still creates a real data-exfiltration surface because scheduled jobs may upload sensitive task outputs or internal notes to a third-party service automatically.

Content

Scanner excerpt · assets/executor_template.py (reported line 184)May include surrounding context.

python
raise EnvironmentError("IMA credentials not configured")

        # Step 1: Create note
        url1 = "https://api.imawiki.com/openapi/note/v1/import_doc"
        data1 = json.dumps({
            "title": f"{TASK_NAME}-{date_str}",
            "content": content,

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This second external transmission adds the created note into a knowledge base on the external IMA platform. While expected for the feature, it extends exposure by persisting content into another remote container, which matters more in an automated recurring archival workflow.

Content

Scanner excerpt · assets/executor_template.py (reported line 201)May include surrounding context.

python
logger.info(f"✅ IMA note created: {note_id}")

        # Step 2: Add to knowledge base
        url2 = "https://api.imawiki.com/openapi/wiki/v1/add_knowledge"
        data2 = json.dumps({
            "kb_id": IMA_KB_ID,
            "media_type": 11,

Tainted flow: 'req2' from urllib.request.urlopen (line 208, network input) → urllib.request.urlopen (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · assets/executor_template.py (reported line 213)May include surrounding context.

python
"ima-openapi-clientid": client_id,
            "ima-openapi-apikey": api_key
        })
        urllib.request.urlopen(req2)
        logger.info(f"✅ Archived to IMA: {note_id}")
        return note_id

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This file contains user-facing instructions solely in Chinese, including the title, field descriptions, and examples. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The markdown explicitly says the archive writes directly to the local filesystem and that same-day reruns overwrite files for idempotency, but it does not warn users about the impact on local data. For markdown files, omission of warnings about behaviors that can affect user data or system integrity qualifies as a finding.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The guide instructs sending briefing content to external services and using API credentials from environment variables, but it does not require any consent, data-classification check, or warning that task output may contain sensitive information. In a cron-task skill that runs automatically, this increases the chance of unattended exfiltration of internal content to third-party systems.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The code posts briefing content to an external IMA API endpoint, creating a real outbound data transmission path. In the context of an automated scheduled task, any sensitive data captured in the briefing could be sent off-host without a human review step.

Content

Scanner excerpt · references/archiving-guide.md (reported line 119)May include surrounding context.

python
import urllib.request, json

url = "https://api.imawiki.com/openapi/note/v1/import_doc"
data = json.dumps({
    "title": f"<task-name>-<date>",
    "content": briefing_content,  # Markdown 内容

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/archiving-guide.md (reported line 139)May include surrounding context.

python
kb_id = os.environ.get("IMA_KB_ID", "<ima_kb_id>")  # FIM知识库

url = "https://api.imawiki.com/openapi/wiki/v1/add_knowledge"
data = json.dumps({
    "kb_id": kb_id,
    "media_type": 11,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The checklist tells the operator to inspect environment variables and create directories, but it does not warn against exposing secrets in terminal output or making unintended filesystem changes. In this skill context, the instructions are operational rather than overtly malicious, but they normalize handling live credentials and mutating the local environment without safety guidance, which can lead to accidental disclosure or unwanted changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This checklist instructs live verification of Feishu credentials by sending app_id and app_secret to an external API, but it does not warn that secrets are being transmitted or discuss safe handling of responses/logs. Even though the destination is the legitimate Feishu API, this still creates a real exposure surface because operators may run it casually, log failures, or reuse the pattern with other services.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This finding is a duplicate view of the same outbound credential-bearing POST request. The danger is not that the endpoint is obviously malicious, but that the skill provides runnable guidance to transmit secrets externally without explicit caution, increasing the chance of accidental leakage through logs, tooling, or operator misunderstanding.

Content

Scanner excerpt · references/readiness-checklist.md (reported line 87)May include surrounding context.

md
import requests, os
app_id = os.environ["FEISHU_APP_ID"]
app_secret = os.environ["FEISHU_APP_SECRET"]
resp = requests.post("https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal", 
    json={"app_id": app_id, "app_secret": app_secret})
if resp.status_code == 200 and "tenant_access_token" in resp.json():
    print("✅ 飞书凭证有效")

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This finding is a duplicate view of the same outbound credential-bearing POST request. The danger is not that the endpoint is obviously malicious, but that the skill provides runnable guidance to transmit secrets externally without explicit caution, increasing the chance of accidental leakage through logs, tooling, or operator misunderstanding.

Content

Scanner excerpt · references/readiness-checklist.md (reported line 87)May include surrounding context.

md
import requests, os
app_id = os.environ["FEISHU_APP_ID"]
app_secret = os.environ["FEISHU_APP_SECRET"]
resp = requests.post("https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal", 
    json={"app_id": app_id, "app_secret": app_secret})
if resp.status_code == 200 and "tenant_access_token" in resp.json():
    print("✅ 飞书凭证有效")

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The template explicitly tells the scheduled agent to run a local Python script via a shell command, which turns a task-creation skill into a runtime code-execution mechanism. In a scheduled, context-poor environment, this is dangerous because any generated prompt can cause unattended execution of arbitrary local code with the agent's available filesystem, network, and credential access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The template instructs the agent to read credentials from environment variables and write outputs to multiple external destinations, including cloud storage and knowledge bases, without requiring disclosure, minimization, or confirmation. In a scheduled workflow this can silently exfiltrate sensitive data, propagate mistakes across systems, and normalize broad access to credentials and external write channels.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The fallback section instructs the agent to execute multiple Python scripts step by step after failure, expanding the blast radius from one script to a full execution chain. This creates an unattended orchestration path that can be abused to run additional code paths, bypass intended scope limits, and interact with local and external resources without fresh user confirmation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.