Security audit
Security checks for vulnerabilities and agentic risk
This timezone skill is purpose-aligned and clearly discloses its local configuration writes, including the optional persistent AGENTS.md change.
This is reasonable to install for timezone-sensitive work. Review the optional --patch-agents behavior before using it, because it writes standing instructions into AGENTS.md for future sessions; normal setup only writes the timezone config.
The manifest description includes very broad activation terms such as 'timezone', 'UTC', 'local time', and any heartbeat where time accuracy matters. This can cause the skill to trigger in many unrelated contexts and then execute prescribed setup or runtime behaviors, including local script execution and file modification, increasing the attack surface and the chance of unintended side effects.
The section 'DST Rules (US Eastern)' and the examples around it center the guidance on America/New_York/Eastern as the expected timezone behavior. This can amount to a natural-language locale policy issue because it biases the skill toward a specific locale without explicit user opt-in or a stated region-specific scope.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"""
# Try timedatectl — args are hardcoded, no user input involved
try:
result = subprocess.run(
["timedatectl", "show", "--property=Timezone", "--value"],
capture_output=True, text=True, timeout=3
)
The script can persistently modify AGENTS.md, which changes future agent behavior across sessions. Even though the code includes explicit confirmation and does not patch silently by default, writing standing instructions into a global agent context is a real persistent-context injection primitive that could be abused if the script is invoked with --patch-agents or integrated into a larger workflow without sufficient trust boundaries.
"""Append timezone standing order to AGENTS.md if not already there.
REQUIRES explicit user confirmation (confirmed=True) or --patch-agents flag.
This modifies a persistent instruction file that affects all future agent behavior.
Never call this silently or as a side effect of detection/setup.
"""
if not confirmed:
The setup section instructs the agent to run a local Python script that writes configuration and patches AGENTS.md, but the description does not clearly warn that installation changes local files. Hidden or poorly disclosed state changes reduce operator awareness and can lead to unintended persistence or configuration tampering, especially when combined with broad activation conditions.
No suspicious patterns detected.