Chronos

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:29 AM UTC
• Version: 1.6.0

Overview

Chronos is a disclosed recurring-task scheduler for OpenClaw, with expected local database, cron, and memory-related system-task behavior that users should configure deliberately.

Before installing, confirm the intended OpenClaw workspace and CHRONOS_CHAT_ID, review any system tasks using special_handler, and run migration/cleanup commands in dry-run mode first. Be aware that complete-overdue can execute the documented Meta-Review and subagent-memory sync handlers and persist audit notes in workspace memory.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (77)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: This finding highlights undeclared special automation such as Meta-Review fallback, subprocess-based subagent memory sync, workspace memory log writes, and automatic overdue completion/archive behavior. In context, these actions can affect other agent subsystems and persistent records, making the skill more dangerous than a simple scheduler because it crosses data, process, and automation boundaries.

Static analysis

No suspicious patterns detected.