ClawHub
Back to skill

Security audit

cron-callback-session

Security checks across malware telemetry and agentic risk

Overview

This skill openly enables cron or external processes to inject messages into other live sessions, but it requires broad session-routing changes and background cross-session control that users should review carefully before installing.

Install only if you intentionally need cross-session cron callbacks and understand that it weakens session isolation for the current agent. Use it in a controlled environment, keep backups, verify the target session key, remove cron jobs after use, and restore tools.sessions.visibility to tree when the cross-session callback is no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Ssd 4

High
Confidence
97% confidence
Finding
The skill explicitly instructs operators to weaken session isolation (`tools.sessions.visibility = agent`) and then use cron or external processes to inject messages into another live session with full context. Even if presented as a productivity feature, this creates a cross-session control channel that can be abused for unauthorized task steering, covert message delivery, or bypassing normal session-bound trust boundaries.

Ssd 1

High
Confidence
95% confidence
Finding
The cron payload is a natural-language instruction that directs another agent/session to invoke `sessions_send` against a specified target while suppressing normal messaging and output patterns. This is dangerous because it semantically redirects model behavior across session boundaries and enables indirect prompt injection or stealthy control transfer into a different conversation context.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.