Security audit
Security checks for vulnerabilities and agentic risk
The skill is a cron helper whose purpose is clear, but it gives agents direct commands to install and rewrite persistent scheduled jobs without strong scoping or confirmation guidance.
Use this only if you want an agent to manage persistent cron jobs on your machine. Before any install, edit, or removal action, require the agent to show the exact crontab change, back up the current crontab, and confirm the job will run only commands you recognize until you remove it.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "=== User crontab ==="
crontab -l 2>/dev/null || echo "(empty)"
echo ""
echo "=== System cron ==="
ls /etc/cron.d/ 2>/dev/null
The skill provides direct commands to add and remove cron entries, which create persistent scheduled execution on the host, but it does not include an explicit warning that these actions modify system behavior beyond the current session. In an agent setting, this can lead to unintended persistence, repeated execution of harmful commands, or stealthy re-execution of user-supplied payloads if the agent applies these commands without strong confirmation.
This command appends a new cron entry via (crontab -l; echo ... ) | crontab -, creating durable scheduled execution on the machine. In an agent workflow, that is a persistence primitive: malicious or mistaken user input could be installed to run repeatedly, potentially evading immediate notice and causing ongoing compromise or disruption.
# Add to user crontab
(crontab -l 2>/dev/null; echo "SCHEDULE COMMAND") | crontab -
# Common schedules:
crontab -e opens the live scheduler configuration for editing, enabling persistence changes that can schedule arbitrary recurring commands. Even though it is interactive, the skill is still instructing the agent/operator to modify durable execution state without emphasizing the security implications.
# Edit crontab interactively
crontab -e
# Or remove a specific line
crontab -l | grep -v "PATTERN_TO_REMOVE" | crontab -
crontab -l | grep -v "PATTERN_TO_REMOVE" | crontab - rewrites the user's crontab and therefore modifies persistent execution state. It can also accidentally remove unintended entries if the pattern is broad, causing denial of service for legitimate scheduled tasks or enabling stealthy tampering with security jobs.
crontab -e
crontab -l | grep -v "PATTERN_TO_REMOVE" | crontab -
### Check cron logs
This example injects environment variables and a scheduled command into the user's crontab, again creating persistent recurring execution. Setting PATH and SHELL can also alter how later cron jobs resolve commands, increasing the blast radius of a mistaken or malicious modification.
# Cron runs with minimal environment. Set what you need:
(crontab -l 2>/dev/null; echo "PATH=/usr/local/bin:/usr/bin:/bin
SHELL=/bin/bash
0 2 * * * /home/user/backup.sh >> /var/log/backup.log 2>&1") | crontab -
The example explicitly shows how to install a nightly cron job, which is a persistence mechanism by design. In a skill intended for general agent use, publishing copy-paste persistence commands without warnings or approval gates makes abuse or accidental long-lived execution more likely.
## Examples
**User:** "Run my backup script every night at 2am"
→ `(crontab -l 2>/dev/null; echo "0 2 * * * /home/user/backup.sh >> /var/log/backup.log 2>&1") | crontab -`
**User:** "Check disk space every hour and alert me if it's over 80%"
→ Create a check script + cron job
No suspicious patterns detected.