Security audit

Cron Watchdog

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed cron watchdog, but it can automatically change and force-run all visible cron jobs and send operational failure details to a fixed Slack channel without clear approval or redaction controls.

Review this before installing in any environment with sensitive or high-impact cron jobs. It should be limited to approved jobs and safe fields, avoid automatic force-runs unless explicitly allowed, cap timeout changes, redact error details, and use an administrator-configured Slack destination rather than a fixed channel.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:33
Finding: Unbounded Autonomous Remediation of Cron Jobs
Content: View full analysis
0`? What was `lastError`? 3. For **model not allowed** errors: use `cron(action: "update", jobId: "...", patch: { payload: { model: "anthropic/claude-sonnet-4-6" } })`, then force-run, log change 4. For **timeout errors**: use `cron(action: "update", jobId: "...", patch: { payload: { timeoutSeconds: } })` — NEVER edit cron JSON files directly 5. For **other errors**: analyze, attempt fix if possible, or flag as unresolved ``` ### Technical Analysis The skill directs the agent to enumerate all cron jobs and autonomously modify any job exhibiting an error. Although model and timeout failures have partially defined remediation procedures, the instruction to “attempt fix if possible” for all other failures creates an unrestricted remediation capability. There is no job allowlist, permitted-field allowlist, patch validation, maximum timeout, change preview, approval gate, or distinction between low-impact jobs and jobs that perform privileged or externally visible operations. The model-error procedure also instructs the agent to force-run the modified job without first evaluating the consequences of execution. The skill therefore allows the agent to use its existing cron-tool privileges outside a narrowly defined monitoring purpose. Error text may influence the agent’s diagnosis, making unsafe remediation possible when a job name or error message contains misleading or attacker-controlled content. ### Attack Path 1. An attacker causes, controls, or influences a cron job failure or its reported `lastError`. 2. The watchdog lists the job and consumes the attacker-influenced error information. 3. The broad “analyze, a ...[truncated 1012 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:18
Finding: Potential Disclosure of Sensitive Error Data to a Hard-Coded Slack Channel
Content: View full analysis
✅ Fixed: — ❌ Unfixable: — ⚠️ Flagged: — ``` Only send if at least one issue exists. ``` ### Technical Analysis The skill mandates a fixed Slack channel identifier, `C0AHYTV5WP7`, rather than requiring a deployment-specific destination supplied and approved by an administrator. It also instructs the agent to include job names, error summaries, issue descriptions, and remediation details in the outgoing report. Cron error messages can contain internal file paths, service names, tenant identifiers, command arguments, URLs, request details, or accidentally exposed credentials. The skill defines no sanitization, secret detection, destination verification, truncation, or sensitivity classification before transmitting this information through the message tool. The channel identifier is not itself demonstrated to be a secret. The security concern is that operational data is automatically transmitted to a fixed external communication destination without verifying that the channel belongs to or is appropriate for the current deployment. ### Attack Path 1. A cron job fails and records sensitive information in its error message or job metadata. 2. The watchdog reads the job name and `lastError` while inspecting failed jobs. 3. The agent incorporates the job name, error summary, issue description, or remediation details into the prescribed report. 4. No redaction or sen ...[truncated 930 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.