ClawHub
Back to skill

Security audit

Cron Scheduler

Security checks for vulnerabilities and agentic risk

Overview

This cron skill does what it says, but it gives agents direct patterns for installing persistent scheduled jobs without enough built-in confirmation or safety guidance.

Review each cron line before allowing the agent to install it. Ask for a dry run or exact preview, back up the existing crontab, avoid broad delete patterns, and make sure every scheduled job has a clear owner, log path, and removal plan.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill provides direct commands to add and remove cron jobs, which permanently change scheduled system behavior, but it does not require confirmation, scoping, or a warning about persistence and unintended execution. In an agent context, this creates a meaningful risk of unauthorized or accidental persistence because a user request could be translated into a cron entry that keeps running after the session ends.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The example `find /tmp -type f -mtime +7 -delete` is a destructive scheduled action that can repeatedly remove files without review, and the skill does not warn about data loss or environment-specific safety concerns. Because it is presented as a common pattern, users or agents may adopt it blindly, causing recurring deletion of files that are still needed by applications or administrators.

Session Persistence

Medium
Category
Rogue Agent
Content
## Examples

**User:** "Run my backup script every night at 2am"
→ `(crontab -l 2>/dev/null; echo "0 2 * * * /home/user/backup.sh >> /var/log/backup.log 2>&1") | crontab -`

**User:** "Check disk space every hour and alert me if it's over 80%"
→ Create a check script + cron job
Confidence
84% confidence
Finding
Using `crontab -l` together with piping a new entry into `crontab -` is a persistence mechanism: it installs a scheduled task that survives beyond the current interaction and can repeatedly execute commands. In a skill designed for automation this is contextually expected, but it still represents session persistence and becomes dangerous if an agent adds jobs without stringent authorization and transparency.

Static analysis

No suspicious patterns detected.