ClawHub
Back to skill

Security audit

Cron To Session Transcript

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about mirroring cron-delivered messages into agent transcripts, but its fallback matching can write persistent content to the wrong transcript.

Install only if you need cron or script deliveries mirrored into OpenClaw session history and you trust every caller that can invoke the helper. Prefer explicit session keys or exact agent/channel/thread values, avoid untrusted message sources, and review or patch the fallback matching before using it in environments with overlapping chat IDs or multiple sessions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/send-to-transcript.sh:190
Finding

Ambiguous Substring Matching Can Poison an Unrelated Agent Session Transcript

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill explicitly performs filesystem writes and invokes an external CLI, but the manifest does not declare any tool scope such as permissions or allowed-tools. That mismatch weakens reviewability and enforcement: an operator or platform cannot reliably tell from the manifest that the skill can modify session transcripts and local state, which increases the chance of overbroad or unintended execution.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

This skill is designed to persist externally generated content into the agent's session transcript, creating durable memory from cron/script-delivered messages that bypass the normal run loop. That persistence can be dangerous because any trusted local script or cron using the helper can inject arbitrary content into long-lived agent memory, potentially influencing later model behavior or contaminating the audit trail.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: cron-to-transcript
description: "Isolated crons, scripts, reminders, and status checkers sent it but the agent forgot? Write deliveries into the session transcript."
metadata: {"openclaw":{"emoji":"⏱️","homepage":"https://github.com/obuchowski/openclaw-cron-to-transcript","os":["linux","darwin"],"requires":{"bins":["bash","python3"]}}}
---

Static analysis

No suspicious patterns detected.