Smart Cron

• Analyzed: May 11, 2026, 4:43 AM
• Findings: 1
• Version: 1.0.0
• Hash: eaf0be247bcb0f86c91380192fdbdd879cbaae9dfc95df080f0ef6016bfeaae8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its reliance on the `exec` tool (declared in `skill.json`) and the ability to schedule arbitrary commands via the `smart-cron add --task` functionality described in `SKILL.md`. While these capabilities are central to a cron scheduler's purpose, they introduce a significant risk of Remote Code Execution (RCE) if the OpenClaw agent is susceptible to prompt injection or if the underlying skill implementation fails to sanitize user-provided task commands before passing them to the system's cron daemon. This represents a critical vulnerability rather than explicit malicious intent within the provided files.