Cron Doctor by Clawra

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only cron troubleshooting skill is purpose-aligned, with the main cautions that it inspects local cron/log data, may use sudo, and saves a local report.

This skill appears safe for its stated purpose, but use it deliberately: allow cron/log reads only on machines you administer, confirm before running any cron job manually or using sudo, and review the generated report for sensitive operational details before sharing it.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may read local cron and log information that reveals system behavior or job details.

Why it was flagged

The skill directs the agent to use local shell commands to inspect cron configuration and logs. This is expected for cron diagnosis, but it gives the agent visibility into local system scheduling and log data.

Skill content
crontab -l
sudo cat /etc/crontab
ls -la /etc/cron.d/
grep CRON /var/log/syslog | tail -50
Recommendation

Use the skill only in environments where you are comfortable letting the agent inspect cron configuration and logs; review commands before allowing broader shell access.

What this means

If approved, the agent may access system-level cron configuration rather than only the current user's crontab.

Why it was flagged

The skill includes a sudo-based command to read system-level cron configuration. This is relevant to diagnosing system cron jobs, but it crosses from user-level inspection into privileged system context.

Skill content
sudo cat /etc/crontab
Recommendation

Only allow sudo use when system cron jobs are in scope, and prefer read-only inspection unless you explicitly approve changes.

What this means

A manual test run could duplicate a scheduled job's effects, such as backups, notifications, deployments, or other automation.

Why it was flagged

The debugging tips include manually running the target script. That is a common cron troubleshooting step, but cron jobs can have real side effects if executed outside their normal schedule.

Skill content
# Verify script runs manually
/path/to/your/script.sh
Recommendation

Ask the agent to get confirmation before running any actual cron job script, especially jobs involving production systems, money, notifications, or data changes.

What this means

Cron job names, paths, error messages, and timing details may be saved in a workspace report file.

Why it was flagged

The skill persists a local report containing job names, errors, and execution history. This is useful for the stated purpose, but the report may capture sensitive operational details.

Skill content
Write to `~/workspace/reports/cron-health-YYYY-MM-DD.md`:

### [Job Name]
- **Error:** [message]
- **Last Success:** [date]
Recommendation

Review the generated report before sharing it, and redact secrets, internal paths, hostnames, or sensitive job details if needed.

What this means

It is less clear which publisher/version is authoritative for this skill.

Why it was flagged

The _meta.json identity/version differs from the registry metadata, and SKILL.md also declares a different version and author. There is no code or install script, so this is a provenance note rather than evidence of harmful behavior.

Skill content
"ownerId": "kn7ch528jxhq32hkqfftr6h5rs81mv68", "slug": "cron-doctor", "version": "1.0.1"
Recommendation

Confirm you trust the publisher and artifact source before installing, especially if a future version adds executable code or install steps.