BigTimer · 定时任务管家（定时消息推送·消息推送·任务管家·定时推送·定时报告·飞书推送）| Scheduled Tasks & Message Push Manager

• Outcome: Review
• Latest audit: Sep 4, 2026 · 3:20 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed scheduler, but it needs Review because it can save recurring shell commands to cron and forward command output to messaging or webhook destinations.

Install only if you intentionally want a tool that can store and run recurring shell commands. Review every `--action`, use `cron-gen` before `install`, prefer `stdout` or trusted OpenClaw delivery for sensitive output, and manually audit/remove crontab entries when deleting tasks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (16)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

---
name: bigtimer
description: "🕐 BigTimer · 定时任务管家 — 定时任务·定时消息推送·任务管家·定时推送·定时提醒·定时报告统一管理（cron 调度 + 消息推送，飞书/多端）。OpenClaw 环境自动走 openclaw cron + message send，DSH 环境自动走 crontab + 飞书 webhook。支持定时任务增删改查、立即执行、调度条目生成，biga/eyes/bigfocus/listform 等技能的定时消息推送可统一接入。触发词：定时任务、定时消息推送、消息推送、任务管家、定时推送、定时提醒、定时报告、定时扫描。| Scheduled tasks & message push manager — cron jobs, scheduled message push, task manager, auto push to Feishu/multi-channel, dual-env (OpenClaw/DSH)."
triggers:
  - 定时任务
  - 定时推送
  - bigtimer
  - BigTimer
  - 定时器
  - 定时提醒
  - 定时报告
  - 定时汇报

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

s": t.get("last_status"),
        })
    return {"ok": True, "tasks": out}

def cmd_remove(args):
    tasks = load_tasks()
    if args.name not in tasks:
        return {"ok": False, "error": f"任务不存在: {args.name}"}
    del tasks[args.name]
    save_tasks(tasks)
    log(f"remove 任务 {args.name}")
    return {"ok": True, "removed": args.name, "tip": "需手动移除系统调度条目（crontab -e / openclaw cron remove）"}

def cmd_status(args):
    tasks = load_tasks()
    if args.name not in tasks:
        return {"ok": False, "error": f"任务不存在: {args.name}"}
    t = tasks[args.name]
    t["env"] = detect_env()
    return {"ok": True, "task": t}

def cmd_run(args):
    tasks = load_tasks()
    if args.name not in tasks:
        return {"ok": False, "error": f"任务不存在: {args.name}"}
    t = tasks[args.name]
    log(f"run 任务 {args.name}: {t['action']}")
    # 执行 action（shell 命令）
    p = subprocess.Popen(["bash", "-c", t["action"]],

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill is presented as a scheduler/message-push manager, but its core runtime executes arbitrary shell commands from task definitions. That mismatch is dangerous because users may grant trust appropriate for reminders or notifications while the skill actually has general command-execution capability and can be used as a remote execution/persistence mechanism.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documentation describes shell execution, environment-dependent behavior, and writing scheduler state, but it does not declare any explicit tool scope or permissions. This weakens review and enforcement boundaries, making it easier for a caller or agent to invoke filesystem and shell capabilities without clear consent or least-privilege constraints.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list contains broad, common phrases like '消息推送', '定时器', and '定时提醒' that are likely to match ordinary user conversation. Overbroad activation can cause the skill to be invoked unintentionally, increasing the chance of accidental task creation, command generation, or scheduler modification in contexts where the user did not mean to use this skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation states that in DSH mode the tool will automatically write to crontab, which modifies persistent system scheduler state. Without a prominent warning and explicit confirmation requirement, users may unknowingly install recurring jobs that continue executing commands and sending data long after the session ends.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

segs = [p.strip() for p in re.split(r"\n{2,}", content) if p.strip()]
    results = []
    for i, seg in enumerate(segs):
        p = subprocess.Popen(
            ["openclaw", "message", "send", "--channel", channel, "--target", target,
             "--message", seg, "--json"],
            stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Task output is sent to an external webhook without explicit privacy disclosure or data minimization controls. Since command output may contain secrets, internal reports, tokens, or host details, silent forwarding to third-party endpoints can cause unintended data exfiltration.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not webhook_url:
        return {"ok": False, "error": "缺少 webhook URL"}
    payload = {"msg_type": "text", "content": {"text": content[:4000]}}
    p = subprocess.Popen(
        ["curl", "-s", "-X", "POST", "-H", "Content-Type: application/json",
         "-d", json.dumps(payload, ensure_ascii=False), webhook_url],
        stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Session Persistence

Medium

• Category: Rogue Agent

Content

del tasks[args.name]
    save_tasks(tasks)
    log(f"remove 任务 {args.name}")
    return {"ok": True, "removed": args.name, "tip": "需手动移除系统调度条目（crontab -e / openclaw cron remove）"}

def cmd_status(args):
    tasks = load_tasks()

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code runs scheduled shell commands without any explicit confirmation, warning, or trust boundary, which is risky for a skill likely to be driven by natural-language requests. This makes accidental or manipulated creation of dangerous recurring commands much more plausible in context.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

t = tasks[args.name]
    log(f"run 任务 {args.name}: {t['action']}")
    # 执行 action（shell 命令）
    p = subprocess.Popen(["bash", "-c", t["action"]],
                         stdout=subprocess.PIPE, stderr=subprocess.PIPE,
                         cwd=os.path.dirname(os.path.abspath(__file__)))
    out, err = p.communicate(timeout=300)

• Confidence: 99% confidence
• Finding: The task action is executed via bash -c using stored task data, which gives the skill arbitrary shell execution capability. Because this is combined with scheduling and persistence features, anyone who can create or modify a task can run arbitrary commands repeatedly, enabling host compromise, data theft, or persistence.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill modifies the user's crontab, which grants persistent host control beyond a simple task manager abstraction. In combination with arbitrary action execution, this enables unattended recurring execution and materially increases the blast radius of misuse or compromise.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# DSH 环境：写入 crontab
    skill_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
    line = gen_crontab_line(t, skill_dir)
    cur = subprocess.run(["crontab", "-l"], capture_output=True, text=True).stdout
    lines = [l for l in cur.splitlines() if f"bigtimer.py run {args.name}" not in l]
    lines.append(line)
    p = subprocess.run(["crontab", "-"], input="\n".join(lines) + "\n", text=True, capture_output=True)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cur = subprocess.run(["crontab", "-l"], capture_output=True, text=True).stdout
    lines = [l for l in cur.splitlines() if f"bigtimer.py run {args.name}" not in l]
    lines.append(line)
    p = subprocess.run(["crontab", "-"], input="\n".join(lines) + "\n", text=True, capture_output=True)
    if p.returncode == 0:
        log(f"install 任务 {args.name} → crontab: {line}")
        return {"ok": True, "env": "dsh", "crontab": line}

• Confidence: 94% confidence
• Finding: This writes generated entries into the user's crontab, creating durable scheduled execution on the host. In the context of this skill, cron installation amplifies the danger of arbitrary command execution by turning a one-time action into persistence that survives the current session.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The user-facing docstring, usage text, and help descriptions are presented in Chinese only. This forces a specific language/locale in natural-language instructions without indicating user choice or a justified locale restriction.

Static analysis

No suspicious patterns detected.