ClawHub
Back to skill

Security audit

Cron Doctor by Clawra

Security checks across malware telemetry and agentic risk

Overview

Cron Doctor is a straightforward cron troubleshooting guide that reads cron configuration and logs and writes a local health report, with no evidence of hidden installation, exfiltration, or persistence.

Install this only if you want an agent to inspect cron-related configuration and recent logs on systems you administer. Approve sudo reads or manual script execution only when appropriate, and review the generated report for sensitive operational details before distributing it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The manifest description lists triggers such as 'job health check' and 'job not running' alongside broader failure terms, but it does not define scope, exclusions, or negative examples. These phrases are generic enough to overlap with ordinary troubleshooting requests that may not be about cron specifically, increasing the chance of accidental activation.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill directs the agent to write a report to '~/workspace/reports/cron-health-YYYY-MM-DD.md', which is a file-modifying action. The document does not warn the user that a file will be created or updated, nor does it ask for confirmation before performing that write.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
# List user's crontab
crontab -l

# List system crontabs
sudo cat /etc/crontab
Confidence
85% confidence
Finding
crontab -l

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.