ClawHub
Back to skill

Security audit

Cron Evaluator

Security checks across malware telemetry and agentic risk

Overview

This cron-auditing skill is mostly related to its stated purpose, but it includes under-disclosed local path scanning, unsafe local model loading, and hard-coded local file interactions that should be reviewed before installation.

Install only if you are comfortable with the agent reading and displaying cron command lines. Before running the v2/v3 scripts, review or remove the hard-coded /mnt, /home/axioma, and /run/media paths, avoid importing unreviewed local modules, and use a verified safe model format or safe PyTorch loading settings.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill advertises shell and file-reading behavior but does not declare corresponding permissions, which undermines least-privilege controls and informed consent by the caller. In this context, the skill is meant to analyze cron jobs, so file access and shell use may be expected, but failing to declare them makes the behavior less transparent and increases the chance of unintended access to sensitive cron-related or adjacent files.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
This is a true and more serious issue: the declared purpose is cron evaluation, but the implementation reportedly scans hard-coded user/workspace paths, interacts with external local ML infrastructure, loads a model from disk, and can train and save a neural network. That materially expands the attack surface, creates opportunities for unauthorized file access and unintended code/model interactions, and makes the skill capable of behavior far beyond what a user would reasonably expect from a cron auditor.

Missing User Warnings

Medium
Confidence
79% confidence
Finding
The skill silently enumerates the current user's cron jobs without any notice, consent prompt, or disclosure that scheduled tasks are being inspected. While this is aligned with the tool's stated purpose, cron entries can contain sensitive operational details, file paths, hostnames, tokens embedded in commands, or maintenance schedules, so undisclosed collection increases privacy and operational exposure risk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.