ClawHub
Back to skill

Security audit

Crontab Wizard

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small local cron-expression helper and I found no hidden persistence, network access, credential use, or destructive behavior.

Installers should understand that this is a local command-line helper for cron syntax. It does not appear to touch real crontab files, but users should still review generated schedules before using them in production jobs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

name: crontab-wizard description: Explain, generate, validate, and preview crontab expressions. Use when a user needs to understand what a cron expression means, create a new cron schedule, check if a cron expression is valid, or see when a cron job will run next. Supports standard 5-field cron syntax and shortcuts like @daily, @hourly, @weekly. No dependencies required.

Crontab Wizard

Decode, generate, validate, and preview cron schedules from the command line. Zero dependencies.

Quick Start

bash
# Explain what a cron expression does
python3 scripts/cronwiz.py explain "*/5 * * * *"

# Generate an expression from options
python3 scripts/cronwiz.py gen

Static analysis

No suspicious patterns detected.