Back to skill

Security audit

Cron 评估器

Security checks across malware telemetry and agentic risk

Overview

This cron-auditing skill is mostly coherent, but it inspects local cron data and can load local code or model files in ways users should review before installing.

Install only if you are comfortable letting the skill read and display cron command lines from the machine where it runs. Prefer using it on pasted or explicitly chosen cron content, avoid the v2 hardcoded workspace workflow, and do not place untrusted files at models/cron_kan.pt or /mnt/Morgana paths before running it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
def scan_all(self):
        crons = []
        try:
            result = os.popen('crontab -l 2>/dev/null').read()
            for line in result.split('\n'):
                line = line.strip()
                if line and not line.startswith('#'):
Confidence
95% confidence
Finding
result = os.popen('crontab -l 2>/dev/null').read()

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill advertises executable commands and file-reading behavior but does not declare permissions, which weakens transparency and any permission-based enforcement around shell and filesystem access. In an agent environment, undeclared capabilities can cause the skill to access local cron files or invoke scripts without the user or platform clearly understanding the risk surface.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
This is a real security concern because the described purpose is high-level cron evaluation, while the detected behavior expands to reading specific local crontab paths, loading local ML model artifacts, and training/saving model data. That mismatch hides materially different capabilities from users and reviewers, making the skill more dangerous in context because cron data and local file paths can reveal sensitive operational details and model-loading code expands the execution and supply-chain attack surface.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
By default, the skill scans multiple hard-coded workspace paths and then also reads the current user's system crontab, even when no specific target is requested. In an agent context, this broadens data access beyond the user's likely intent and can expose operational schedules, commands, internal paths, and maintenance routines from unrelated environments.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill's stated purpose is cron evaluation, but the implementation autonomously enumerates the host user's crontab instead of analyzing user-provided cron data. That creates a stronger host-interaction and data-access capability than is strictly necessary, which can expose sensitive commands, paths, credentials embedded in cron lines, or internal operational details.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill reads the user's crontab, which may contain sensitive operational details such as internal paths, credentials embedded in commands, backup schedules, and maintenance tasks, without any user-facing disclosure or consent step. In an agent skill context, silent collection of scheduled task data increases privacy and security risk because it exposes system behavior and potentially secrets beyond what a user may expect from a simple evaluation action.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The code performs local cron inspection without any explicit user notice, confirmation, or explanation. While this is not command injection, the silent system inspection weakens transparency and informed consent, increasing the risk of unexpected disclosure of host scheduling data.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.