ClawHub
Back to skill

Security audit

Cron Doctor

Security checks for vulnerabilities and agentic risk

Overview

Cron Doctor is a small local cron-file checker; its only notable risk is an optional CI helper that can run Python tests when explicitly used on a target folder.

Install this if you want a lightweight local checker for cron-style files. Use cron_doctor.py on files you choose; treat ci/verify_product.py like any test runner and avoid running it against untrusted repositories unless it is isolated from secrets and sensitive filesystem access.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def has_self_test(fp):
    r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
    return r.returncode == 0 and "PASS" in r.stdout
Confidence
98% confidence
Finding
This function executes an arbitrary Python file from the target product directory (`fp`) as part of verification. In a CI context, running untrusted repository code during validation can lead to arbitrary code execution, secret exfiltration, filesystem tampering, or lateral movement, even though `subprocess.run` is invoked without a shell.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
tests = [os.path.join(folder, f) for f in os.listdir(folder)
                 if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
        if tests:
            st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
                                      timeout=30).returncode == 0 for t in tests)
            st_note = f"{len(tests)} test_*.py"
        elif re.search(r"(?im)^test\s*:", skill_txt):
Confidence
98% confidence
Finding
This code executes any `test_*.py` or `*_test.py` file found in the target folder. Since those files come from the untrusted product under verification, an attacker can place malicious code in a test file and gain arbitrary code execution in CI or on the verifier's machine.

Static analysis

No suspicious patterns detected.