ClawHub
Back to skill

Security audit

Schedule

Security checks for vulnerabilities and agentic risk

Overview

This scheduling skill is transparent about storing local schedules and only running user-defined tasks with explicitly granted permissions.

Before installing, treat scheduled task text as locally stored data: avoid putting secrets in job descriptions, review any skills or permissions listed in a job before approving it, and delete jobs or history you no longer want retained.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

ope

This skill:

  • ✅ Stores scheduled job definitions in ~/schedule/
  • ✅ Triggers jobs at specified times
  • ✅ Learns timezone and time preferences from user

Execution model:

  • User explicitly defines WHAT the job does
  • User grants any permissions needed for the job
  • Skill only handles WHEN, not WHAT

This skill does NOT:

  • ❌ Assume access to any external service
  • ❌ Modify system crontab or launchd
  • ❌ Execute jobs without user-defined instructions

Quick Reference

TopicFile
Cron expression syntaxpatterns.md
Common mistakestraps.md
Job formatjobs.md

Core Rules

1. User Defines Everything

When user requests a scheduled task:

  1. WHAT: User specifies the action (may require other skills/permissions)
  2. WHEN: This skill handles timing
  3. HOW: User grants any needed access explicitly

Example flow:

text
User: "Every morning, summarize my emails"
Agent: "I'll schedule this for 8am. This will need ema

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documentation specifies persistent storage of the user's exact task text, timezone, and related metadata in a local file, but it does not mention consent, retention limits, or user-facing disclosure. Because scheduled tasks can contain sensitive personal content, this creates a privacy risk if users are unaware their requests are being stored or if the local file is later accessed by other processes or users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.