ClawHub
Back to skill

Security audit

Chronos

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says: add local time-tracking hooks for agents, with disclosed but security-relevant persistent hook and logging behavior.

Install this only if you are comfortable with persistent agent hooks running on routine session, prompt, tool-use, and stop events and with local tool-use timing metadata being kept under ~/.chronos. Prefer project-scoped installation where available, review the generated hook commands first, keep the backups, and avoid the Windows PowerShell bypass variant in environments with strict script-execution policy.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (44)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The declared description presents the skill as providing temporal-awareness functionality to agents at runtime. However, the supplied code chunk does not implement time reasoning, ledger management, recency checks, cooldown logic, idle detection, or decision rules. Instead, it is an installer script whose primary purpose is deployment: it edits Claude hook configuration, preserves existing hooks, backs up config, and installs/removes skill assets. Those are materially different capabilities from the declared behavioral purpose. While installation is related to packaging the skill, this chunk itself performs undeclared configuration and filesystem modification actions rather than the described temporal-awareness behavior, so this is a description-behavior mismatch.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The declared purpose describes a runtime capability for time-aware agent reasoning, but the supplied code does not implement any temporal ledger, decision rules, recency checks, cooldown handling, or related agent behavior. Instead, it performs installer support logic by detecting the available shell and choosing an appropriate settings file. This is a materially different primary purpose, so it should be flagged as a mismatch.

Agent Config Directory Access

High
Category
Agent Snooping
Content
if [ "$SCOPE" = project ]; then
    mkdir -p .claude; TARGET=.claude/settings.json
  else
    mkdir -p "$HOME/.claude"; TARGET="$HOME/.claude/settings.json"
  fi
fi
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High
Category
Agent Snooping
Content
{
  "_comment": "chronos — drop these entries into ~/.claude/settings.json or .claude/settings.json. Replace ${CHRONOS_ROOT} with the absolute path to your chronos checkout, e.g. /c/Users/you/Documents/here-now-projects/chronos. On Windows with Git Bash, .sh paths work. For pure PowerShell, use the .ps1 variants below and set shell to powershell.",
  "hooks": {
    "SessionStart": [
      {
Confidence
91% confidence
Finding
The file instructs users to add command hooks to ~/.claude/settings.json, a trusted agent configuration location that enables automatic execution of local shell scripts during agent lifecycle events. Writing persistence into a high-trust config directory is security-sensitive because it causes code to run implicitly in future sessions, and in this case the hooks are broad and frequent, making the skill more dangerous than a passive configuration snippet.

Agent Config Directory Access

High
Category
Agent Snooping
Content
{
  "_comment": "chronos — drop these entries into ~/.claude/settings.json or .claude/settings.json. Replace ${CHRONOS_ROOT} with the absolute path to your chronos checkout, e.g. /c/Users/you/Documents/here-now-projects/chronos. On Windows with Git Bash, .sh paths work. For pure PowerShell, use the .ps1 variants below and set shell to powershell.",
  "hooks": {
    "SessionStart": [
      {
Confidence
91% confidence
Finding
The file instructs users to add command hooks to ~/.claude/settings.json, a trusted agent configuration location that enables automatic execution of local shell scripts during agent lifecycle events. Writing persistence into a high-trust config directory is security-sensitive because it causes code to run implicitly in future sessions, and in this case the hooks are broad and frequent, making the skill more dangerous than a passive configuration snippet.

Agent Config Directory Access

High
Category
Agent Snooping
Content
{
  "_comment": "chronos — drop these entries into ~/.claude/settings.json or .claude/settings.json. Replace ${CHRONOS_ROOT} with the absolute path to your chronos checkout, e.g. /c/Users/you/Documents/here-now-projects/chronos. On Windows with Git Bash, .sh paths work. For pure PowerShell, use the .ps1 variants below and set shell to powershell.",
  "hooks": {
    "SessionStart": [
      {
Confidence
91% confidence
Finding
The file instructs users to add command hooks to ~/.claude/settings.json, a trusted agent configuration location that enables automatic execution of local shell scripts during agent lifecycle events. Writing persistence into a high-trust config directory is security-sensitive because it causes code to run implicitly in future sessions, and in this case the hooks are broad and frequent, making the skill more dangerous than a passive configuration snippet.

Agent Config Directory Access

High
Category
Agent Snooping
Content
{
  "_comment": "chronos — drop these entries into ~/.claude/settings.json or .claude/settings.json. Replace ${CHRONOS_ROOT} with the absolute path to your chronos checkout, e.g. /c/Users/you/Documents/here-now-projects/chronos. On Windows with Git Bash, .sh paths work. For pure PowerShell, use the .ps1 variants below and set shell to powershell.",
  "hooks": {
    "SessionStart": [
      {
Confidence
91% confidence
Finding
The file instructs users to add command hooks to ~/.claude/settings.json, a trusted agent configuration location that enables automatic execution of local shell scripts during agent lifecycle events. Writing persistence into a high-trust config directory is security-sensitive because it causes code to run implicitly in future sessions, and in this case the hooks are broad and frequent, making the skill more dangerous than a passive configuration snippet.

Vague Triggers

High
Confidence
98% confidence
Finding
All hook matchers are empty strings, which causes the hooks to trigger for every matching lifecycle event without restriction. In this skill, that means PowerShell scripts execute automatically on session start, prompt submission, tool use, and stop, greatly expanding the execution surface and increasing the chance of unintended or unsafe code running in response to ordinary agent activity.

Agent Config Directory Access

High
Category
Agent Snooping
Content
{
  "_comment": "chronos — Codex CLI hooks. Drop into ~/.codex/hooks.json (user) or <repo>/.codex/hooks.json. Also add [features] codex_hooks = true to ~/.codex/config.toml. Replace ${CHRONOS_ROOT}. Note: Codex PreToolUse matches Bash only; Read/Write/Edit tool events may be unavailable until coverage extends.",
  "hooks": {
    "SessionStart": [
      { "command": "bash ${CHRONOS_ROOT}/scripts/session_start.sh" }
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High
Category
Agent Snooping
Content
{
  "_comment": "chronos — Codex CLI hooks. Drop into ~/.codex/hooks.json (user) or <repo>/.codex/hooks.json. Also add [features] codex_hooks = true to ~/.codex/config.toml. Replace ${CHRONOS_ROOT}. Note: Codex PreToolUse matches Bash only; Read/Write/Edit tool events may be unavailable until coverage extends.",
  "hooks": {
    "SessionStart": [
      { "command": "bash ${CHRONOS_ROOT}/scripts/session_start.sh" }
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High
Category
Agent Snooping
Content
{
  "_comment": "chronos — Codex CLI hooks. Drop into ~/.codex/hooks.json (user) or <repo>/.codex/hooks.json. Also add [features] codex_hooks = true to ~/.codex/config.toml. Replace ${CHRONOS_ROOT}. Note: Codex PreToolUse matches Bash only; Read/Write/Edit tool events may be unavailable until coverage extends.",
  "hooks": {
    "SessionStart": [
      { "command": "bash ${CHRONOS_ROOT}/scripts/session_start.sh" }
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High
Category
Agent Snooping
Content
mv "$TMP" "$TARGET"

# Enable feature flag
CONF="$HOME/.codex/config.toml"
[ -f "$CONF" ] || touch "$CONF"
if ! grep -q '^\s*codex_hooks\s*=\s*true' "$CONF" 2>/dev/null; then
  if ! grep -q '^\[features\]' "$CONF" 2>/dev/null; then
Confidence
96% confidence
Finding
This installer directly modifies the agent's Codex configuration under $HOME/.codex/config.toml to enable hooks, which is a privileged agent-control surface. In the context of an agent skill, changing hook-related config can alter future agent behavior and persistence without interactive confirmation, making it security-relevant even if the stated purpose is legitimate.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Session Persistence

Medium
Category
Rogue Agent
Content
To add chronos support for a new agent platform:

1. Create `installers/<platform>/README.md` describing the platform's hook or plugin API
2. Write the context injection: SessionStart must emit `now_utc`, `now_local`, `tz`, `ledger`, `state`, `session`
3. Write per-turn injection: UserPromptSubmit must emit `turn`, `session_duration`, `since_last_user`
4. Write the ledger writer: PreToolUse appends `started_at`, PostToolUse appends `finished_at + duration_ms + success`
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## The problem

LLMs do not know what time it is. They guess. They report "just now" when it was two hours ago. They retry failed commands without checking that the last attempt was 10 seconds ago. They run silently in autonomous loops with no idle detection.

[Arxiv 2510.23853](https://arxiv.org/abs/2510.23853) measured this empirically: even frontier models with timestamps injected into context reach only **65% temporal reasoning alignment** with human judgment. Timestamps appear in fewer than 4% of reasoning traces. The ceiling exists because having access to timestamps is not enough. Agents need explicit rules for *when to look at the clock*.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The README prominently describes persistent per-session ledgering of tool activity, timestamps, session duration, and hashed arguments, but it does not provide a clear privacy warning at the point of installation or data collection. Even if `args_hash` reduces direct exposure, the ledger still creates behavioral telemetry that may reveal workflows, timing patterns, and sensitive tool usage over time.

Session Persistence

Medium
Category
Rogue Agent
Content
### OpenCode

```bash
mkdir -p ~/.config/opencode/plugins
cp installers/opencode/plugin.ts ~/.config/opencode/plugins/chronos.ts
mkdir -p ~/.config/opencode/skills/chronos
cp SKILL.md ~/.config/opencode/skills/chronos/SKILL.md
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium
Confidence
97% confidence
Finding
The activation condition is intentionally expansive: it triggers on recency, retry windows, staleness, cooldowns, idle detection, and essentially any 'when / how long ago' question. Overly broad activation can cause unintended invocation in unrelated contexts, increasing the chance an agent unnecessarily consults shell tools or ledger paths and exposing more operational metadata than needed.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
# path may vary by ADAL version — check docs
mkdir -p ~/.adal/skills/chronos
cp SKILL.md ~/.adal/skills/chronos/SKILL.md
cp AGENTS.md ~/.adal/skills/chronos/AGENTS.md
```
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script performs state-changing actions before honoring dry-run mode: it creates the target directory/file earlier and, in project mode, may create .claude plus settings.json before the later dry-run check exits. A dry-run option is expected to be side-effect free, so this can unexpectedly alter agent configuration state and filesystem contents even when the user requested simulation only.

Vague Triggers

Medium
Confidence
95% confidence
Finding
All hook entries use an empty matcher, which makes them apply to every matching lifecycle event rather than a narrowly scoped subset. In this skill, that means arbitrary local shell scripts are invoked on every session start, prompt submission, tool invocation, and stop event, increasing attack surface and making any bug, compromise, or unexpected side effect in those scripts trigger globally.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The manifest invokes PowerShell with -ExecutionPolicy Bypass for every automated hook, which suppresses an important platform safeguard and allows unsigned or locally modified scripts to run without normal policy checks. Because these hooks are broad and automatic, any compromise of the script files or installation path could lead to repeated arbitrary code execution during routine agent operations.

Vague Triggers

Medium
Confidence
93% confidence
Finding
This manifest registers hooks for generic lifecycle events such as SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, and Stop, but provides no limiting conditions, exclusions, or context boundaries for when they should or should not run. Because these events are broadly named and always wired to shell commands, the configuration can cause unintended invocations across normal Codex usage.

Session Persistence

Medium
Category
Rogue Agent
Content
## Install (project)

```bash
mkdir -p .cursor/rules
cp .cursor/rules/chronos.mdc .cursor/rules/chronos.mdc
```
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.