Security audit
Security checks for vulnerabilities and agentic risk
The bundled cron checker is mostly purpose-aligned, but its install instructions tell users to download and run mutable remote Python code without integrity verification.
Installers should prefer the bundled cron_doctor.py or require a pinned commit plus checksum before running any downloaded code. Avoid running the included CI verifier against untrusted folders unless it is sandboxed and has no secrets or broad workspace access.
SKILL.md:32Mutable Remote Python Payload Downloaded Without Integrity Verification
ci/ci_check.py:13Deployment Validation Silently Skips the Actual Skill Package
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
en(issues)} -> {'VALID' if res['valid'] else 'INVALID'}")
for iss in issues: print(" !", iss)
return res
def self_test():
import tempfile
good = tempfile.NamedTemporaryFile("w", suffix=".txt", delete=False)
good.write("30m tick\n0 9 * * * backup\n")
good.close()
bad = tempfile.NamedTemporaryFile("w", suffix=".txt", delete=False)
bad.write("every 5x do thing\nrm -rf / important\n")
bad.close()
g = check(good.name, False); b = check(bad.name, False)
os.unlink(good.name); os.unlink(bad.name)
ok = g["valid"] and not b["valid"] and len(b["issues"]) == 2
print("self-test:", "PASS" if ok else "FAIL", f"(good={g['valid']} bad_issues={len(b['issues'])})")
return 0 if ok else 1
def main():
p = argparse.ArgumentParser(description="cron-doctor")
sub = p.add_subparsers(dest="cmd", required=True)
c = sub.add_parser("check"); c.add_argument("path"); c.add_argument("--json", action="store_true")
sub.add_parser("self-test"
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
| Alternative | Why this skill is better |
|---|---|
| crontab -l and hope | Parses, validates, and explains failures. |
| Cron lint gists | Adds unsafe-command detection and collisions. |
| Debugging at 3am | Catch it before the run, not after. |
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
| Alternative | Why this skill is better |
|---|---|
| crontab -l and hope | Parses, validates, and explains failures. |
| Cron lint gists | Adds unsafe-command detection and collisions. |
| Debugging at 3am | Catch it before the run, not after. |
This function executes an arbitrary Python file from the target product directory as part of verification. In a CI or reviewer context, an attacker can place malicious code in a product file that advertises a self-test, causing code execution on the verifier host with the CI job's privileges.
def has_self_test(fp):
r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
return r.returncode == 0 and "PASS" in r.stdout
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
all_ok &= axis(False, "frontmatter (no SKILL.md)")
all_ok &= axis(False, "docs (no SKILL.md)")
# 3 compiles
comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp],
capture_output=True).returncode == 0 for fp in files)
all_ok &= axis(comp_ok, "compiles (py_compile all .py)")
# 4 self-test (any of 3 valid forms)
This verifier executes any test_*.py or *_test.py file found in the target folder. Because those test files are attacker-supplied product content, this creates arbitrary code execution in CI or local verification environments and can expose tokens, workspace data, or enable lateral movement.
tests = [os.path.join(folder, f) for f in os.listdir(folder)
if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
if tests:
st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
timeout=30).returncode == 0 for t in tests)
st_note = f"{len(tests)} test_*.py"
elif re.search(r"(?im)^test\s*:", skill_txt):
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
# 7 deploy-ready
ci = os.path.join(os.path.dirname(os.path.abspath(__file__)), "ci_check.py")
if os.path.isfile(ci) and os.path.isfile(skill):
r = subprocess.run([sys.executable, ci], cwd=folder, capture_output=True, text=True)
all_ok &= axis(r.returncode == 0, "deploy-ready (ci/ci_check.py PASS)")
else:
all_ok &= axis(True, "deploy-ready (skipped)")
No suspicious patterns detected.