Security audit

Cron Mastery

Security checks across malware telemetry and agentic risk

Overview

This documentation-only cron skill is mostly purpose-aligned, but its ready-to-copy examples include privileged cleanup, destructive recovery advice, hard-coded external delivery, and recurring email access without enough user-control warnings.

Install only if you are comfortable reviewing and rewriting the templates before use. Replace all hard-coded Telegram IDs, require explicit user approval before any job reads email or sends summaries externally, run janitor cleanup with a preview or narrow scope, and back up cron state before any manual jobs.json deletion.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill instructs users to manually delete an internal gateway state file (`~/.openclaw/state/cron/jobs.json`) as a troubleshooting step. This is a destructive action outside the normal scope of a scheduling guidance skill and can cause loss of scheduled jobs, state corruption, or unsafe operator behavior if followed without safeguards.

Context-Inappropriate Capability

Low

Confidence: 76% confidence
Finding: Directing the agent to write a user's timezone into `MEMORY.md` introduces persistent storage of personal preference data without necessity or consent controls in the skill itself. While timezone can be relevant to scheduling, the instruction expands capability from scheduling guidance into profile storage and may create privacy and retention issues.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The recurring 'Morning Briefing' template goes beyond a scheduling helper by instructing the agent to access unread emails and external news. That expands the skill from time orchestration into data-access and content-processing behavior, increasing privacy and permission risk if reused blindly by downstream agents or users.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The 'Janitor' template explicitly recommends running in the main session with full tool access, which violates least-privilege for a scheduling-oriented skill. If adopted as-is, a scheduled maintenance task could operate with broader authority than necessary and perform unintended destructive or sensitive actions.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The troubleshooting advice recommends deleting an internal state file without a prominent warning about irreversible loss of cron state or the need for backups. In context, operators may treat this as routine guidance and accidentally destroy reminders or recurring job configuration.

Missing User Warnings

Low

Confidence: 72% confidence
Finding: The skill tells the operator to persist timezone data in `MEMORY.md` but gives no privacy warning, consent requirement, or retention guidance. Even though timezone helps with cron accuracy, it is still user data, and normalizing silent persistence can lead to unnecessary long-term storage of personal context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The reminder template hard-codes a Telegram recipient and schedules external delivery without warning that job content leaves the local system. This creates a real risk of misdelivery or disclosure if users copy the template unchanged or assume the destination is dynamically tied to the requesting user.

Missing User Warnings

High

Confidence: 97% confidence
Finding: This template combines access to private email content with outbound Telegram delivery, yet provides no warning or consent language about either the sensitive data access or external transmission. In a scheduling skill, that mismatch is especially dangerous because users may treat the template as a harmless timing example while it actually operationalizes recurring exfiltration of personal information.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.