ClawHub
Back to skill

Security audit

Cron Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a cron task manager, but it stores and runs arbitrary shell commands with weak scoping and file-path validation.

Review this skill carefully before installing. Only use it in a low-privilege, trusted workspace, do not allow untrusted users or agents to create tasks, avoid sensitive environment variables, and treat every saved task command as code that may execute on the host.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/cron_manager.py:281
Finding

Unrestricted Stored Shell Command Execution

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/cron_manager.py:136
Finding

Path Traversal Through Unvalidated Task IDs

Content
View full analysis
list: """Get execution logs for a task.""" log_file = os.path.join(LOGS_DIR, f"{task_id}.jsonl") if not os.path.exists(log_file): return [] with open(log_file, 'r') as f: return [json.loads(line) for line in f if line.strip()] def add_log_entry(task_id: str, entry: dict): """Add a log entry for task execution.""" log_file = os.path.join(LOGS_DIR, f"{task_id}.jsonl") with open(log_file, 'a') as f: f.write(json.dumps(entry) + '\n') ``` ```python def cmd_add(args): """Add a new cron task.""" tasks = load_tasks() # Check for duplicate ID if any(t['id'] == args.name for t in tasks): return {'status': 'error', 'message': f'Task {args.name} already exists'} schedule = parse_schedule(args.schedule) if not schedule: return {'status': 'error', 'message': f'Failed to parse schedule: {args.schedule}'} new_task = { 'id': args.name, 'name': args.name, 'command': args.command, 'schedule': args.schedule, 'schedule_parsed': schedule, 'timezone': args.timezone or 'UTC', 'status': 'active', 'created_at': datetime.now(pytz.UTC).isoformat(), 'last_run': None, 'success_count': 0, 'failure_count': 0, 'total_runs': 0, } tasks.append(new_task) save_tasks(tasks) ``` ```python def cmd_remove(args): """Remove a cron task.""" tasks = load_tasks() tasks = [t for t in tasks if t['id'] != args.task_id] save_tasks(tasks) # Clean up logs log_file = os.path.join(LOGS_DIR, f"{args.task_id}.jsonl") if os.path.exists(log_file): os.remove(log_file) ``` ### T ...[truncated 2329 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
Run from the `scripts/cron_manager.py` script with these actions:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

This is a clear tool-parameter abuse risk: task['command'] is attacker-influenced input executed by the shell. Because the skill is specifically designed to manage recurring tasks for autonomous agents, the context makes this more dangerous than a normal admin-only cron wrapper; it can become a convenient persistence and remote-execution mechanism if task creation or task-file modification is exposed.

Content

Scanner excerpt · scripts/cron_manager.py (reported line 292)May include surrounding context.

python
# Execute the command
    start = datetime.now(pytz.UTC)
    try:
        result = subprocess.run(task['command'], shell=True, capture_output=True, text=True, timeout=300)
        success = result.returncode == 0
        output = result.stdout[-1000:] if result.stdout else ''
        error = result.stderr[-1000:] if result.stderr else ''

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The markdown advertises cron remove <task_id> — Delete a task but provides no warning that the action is destructive or irreversible, and no mention of confirmation requirements. For a skill that manages scheduled tasks, deleting a task can affect system behavior and user data continuity, so the description should explicitly disclose that risk.

Content

No source excerpt is available for this finding.

Tainted flow: 'TASKS_FILE' from os.environ.get (line 37, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
83% confidence
Finding

TASKS_FILE is derived from CRON_DATA_DIR, an environment-controlled path, and is opened for writing without validation. If this script runs with elevated privileges or in a shared environment, an attacker controlling the environment could redirect writes to unintended files or sensitive locations via path manipulation or symlink abuse.

Content

Scanner excerpt · scripts/cron_manager.py (reported line 60)May include surrounding context.

python
def save_tasks(tasks: list):
    """Save tasks to JSON file."""
    with open(TASKS_FILE, 'w') as f:
        json.dump(tasks, f, indent=2)

Tainted flow: 'log_file' from os.environ.get (line 246, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
86% confidence
Finding

The log file path is influenced by LOGS_DIR (derived from environment-controlled DATA_DIR) and task_id, then opened for append without path or symlink validation. An attacker who controls the environment or task identifier format could cause log writes to unintended filesystem locations, especially if the process has broader write permissions.

Content

Scanner excerpt · scripts/cron_manager.py (reported line 149)May include surrounding context.

python
def add_log_entry(task_id: str, entry: dict):
    """Add a log entry for task execution."""
    log_file = os.path.join(LOGS_DIR, f"{task_id}.jsonl")
    with open(log_file, 'a') as f:
        f.write(json.dumps(entry) + '\n')

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The remove command rewrites the tasks file and deletes the associated log file, which is an irreversible data-destructive operation. Although the module docstring lists a remove action, there is no confirmation prompt, explicit warning, or user-facing disclosure at the point of deletion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Immediate command execution without any warning or confirmation is dangerous here because the implementation runs stored commands directly on the host system. In agent-integrated tooling, this lowers the barrier for accidental or manipulated execution of destructive commands and amplifies the risk posed by the shell-based command runner.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
99% confidence
Finding

The code executes task['command'] with shell=True, which allows arbitrary shell command execution from task definitions stored in JSON or added via the CLI. In an agent skill context, this is especially dangerous because untrusted users or upstream agent workflows may be able to register or modify tasks, turning the feature into unrestricted OS command execution.

Content

Scanner excerpt · scripts/cron_manager.py (reported line 292)May include surrounding context.

python
# Execute the command
    start = datetime.now(pytz.UTC)
    try:
        result = subprocess.run(task['command'], shell=True, capture_output=True, text=True, timeout=300)
        success = result.returncode == 0
        output = result.stdout[-1000:] if result.stdout else ''
        error = result.stderr[-1000:] if result.stderr else ''

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/cron_manager.py (reported line 401)May include surrounding context.

python
stale_count = 0
    
    # Check disk space
    disk_usage = subprocess.run(['df', '-h', DATA_DIR], capture_output=True, text=True)
    
    health_issues = []
    if failed_tasks:

Tainted flow: 'DATA_DIR' from os.environ.get (line 36, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/cron_manager.py (reported line 401)May include surrounding context.

python
stale_count = 0
    
    # Check disk space
    disk_usage = subprocess.run(['df', '-h', DATA_DIR], capture_output=True, text=True)
    
    health_issues = []
    if failed_tasks:

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The inline comment says the code will check for stale logs, but the implementation only initializes stale_threshold and stale_count and never inspects any log files or uses those values in the result. This is an intent-code divergence because the comment describes a diagnostic capability the function does not actually perform.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.