Security audit

Cron Helper

Security checks for vulnerabilities and agentic risk

Overview

This cron helper is purpose-aligned and low impact, with documentation accuracy and dependency-pinning cautions but no evidence of hidden or harmful behavior.

This skill is reasonable to install for local cron-expression help. Be aware that 6-field cron support is not consistently implemented, and run it in a normal least-privilege environment. For stricter supply-chain control, pin `rich` and `croniter` or use a committed lockfile before automated use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: scripts/cron.py:1
Finding: Unpinned Third-Party Dependencies Are Automatically Resolved and Executed
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The overall purpose mostly aligns: the script explains cron expressions, generates some cron expressions from English phrases, validates them, and shows future run times. However, there is a material mismatch in capability: the description explicitly claims support for both standard 5-field and 6-field cron with seconds, but the code consistently enforces exactly 5 fields in explain and validate, and its metadata/field definitions only cover five fields. The generate logic also emits only 5-field expressions. While croniter may parse more formats in the next command, the skill as implemented does not meaningfully provide the declared 6-field support. Additionally, the natural-language generation is narrow and pattern-based rather than broad conversion, though this is a lesser mismatch. There are no undeclared sensitive behaviors or resource accesses.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The top-level docstring describes the tool as explaining, generating, validating, and previewing cron expressions without noting format restrictions, while the implementation of explain and validate hard-fails on non-5-field input. Given the manifest explicitly mentions 6-field support, this omission creates a behavioral mismatch in the skill's claimed capabilities.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest says the skill works with standard 5-field and 6-field cron expressions, including seconds. However, the explain command rejects anything other than 5 fields, and the validate path does the same, so documented capability is not actually implemented for those operations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.