ClawHub
Back to skill

Security audit

chronos

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-aligned: it installs local timing hooks and keeps a local activity ledger so agents can reason about time more accurately.

Install only if you are comfortable with persistent local agent hooks that run on session, prompt, tool, and stop events and write timing metadata to a local ledger. For sensitive projects, prefer project-scoped installation where available, review the generated Claude/Codex config diffs, set CHRONOS_HOME and retention values deliberately, and keep the installer source pinned or reviewed before use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (47)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The declared description focuses on runtime temporal-awareness functionality for coding agents. The provided code chunk does not implement temporal reasoning, ledger logic, recency evaluation, cooldown checks, or decision rules. Instead, it is purely deployment/setup logic: it installs or removes hooks in Claude configuration and copies skill assets into place. While an installer can be a supporting component of such a skill, this specific chunk’s actual behavior is materially different from the declared primary purpose and exercises undeclared capabilities involving filesystem writes and configuration changes. Therefore this code chunk does not accurately match the declared behavior.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The declared description focuses on runtime temporal-awareness behavior for AI coding agents, but the supplied code chunk does not implement time reasoning, ledger logic, recency checks, cooldown rules, or idle detection. Instead, it performs installation and configuration of Codex hooks by editing local files and enabling a feature flag. While this may support the broader skill, the actual code's primary purpose is setup/installation, which is materially different from the declared operational behavior. The file system access and configuration changes are also undeclared in the provided permissions/description.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The code does not implement temporal awareness, time reasoning, ledger logic, hooks, retry/cooldown handling, or any decision rules related to recency. Its primary purpose is environment detection for installation/setup, specifically choosing bash vs PowerShell and selecting a matching settings file. That is materially different from the declared purpose, so this is a clear description-behavior mismatch.

Agent Config Directory Access

High
Category
Agent Snooping
Content
if [ "$SCOPE" = project ]; then
    mkdir -p .claude; TARGET=.claude/settings.json
  else
    mkdir -p "$HOME/.claude"; TARGET="$HOME/.claude/settings.json"
  fi
fi
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High
Category
Agent Snooping
Content
{
  "_comment": "chronos — drop these entries into ~/.claude/settings.json or .claude/settings.json. Replace ${CHRONOS_ROOT} with the absolute path to your chronos checkout, e.g. /c/Users/you/Documents/here-now-projects/chronos. On Windows with Git Bash, .sh paths work. For pure PowerShell, use the .ps1 variants below and set shell to powershell.",
  "hooks": {
    "SessionStart": [
      {
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High
Category
Agent Snooping
Content
{
  "_comment": "chronos — drop these entries into ~/.claude/settings.json or .claude/settings.json. Replace ${CHRONOS_ROOT} with the absolute path to your chronos checkout, e.g. /c/Users/you/Documents/here-now-projects/chronos. On Windows with Git Bash, .sh paths work. For pure PowerShell, use the .ps1 variants below and set shell to powershell.",
  "hooks": {
    "SessionStart": [
      {
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High
Category
Agent Snooping
Content
{
  "_comment": "chronos — drop these entries into ~/.claude/settings.json or .claude/settings.json. Replace ${CHRONOS_ROOT} with the absolute path to your chronos checkout, e.g. /c/Users/you/Documents/here-now-projects/chronos. On Windows with Git Bash, .sh paths work. For pure PowerShell, use the .ps1 variants below and set shell to powershell.",
  "hooks": {
    "SessionStart": [
      {
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High
Category
Agent Snooping
Content
{
  "_comment": "chronos — drop these entries into ~/.claude/settings.json or .claude/settings.json. Replace ${CHRONOS_ROOT} with the absolute path to your chronos checkout, e.g. /c/Users/you/Documents/here-now-projects/chronos. On Windows with Git Bash, .sh paths work. For pure PowerShell, use the .ps1 variants below and set shell to powershell.",
  "hooks": {
    "SessionStart": [
      {
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High
Category
Agent Snooping
Content
{
  "_comment": "chronos — Codex CLI hooks. Drop into ~/.codex/hooks.json (user) or <repo>/.codex/hooks.json. Also add [features] codex_hooks = true to ~/.codex/config.toml. Replace ${CHRONOS_ROOT}. Note: Codex PreToolUse matches Bash only; Read/Write/Edit tool events may be unavailable until coverage extends.",
  "hooks": {
    "SessionStart": [
      { "command": "bash ${CHRONOS_ROOT}/scripts/session_start.sh" }
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High
Category
Agent Snooping
Content
{
  "_comment": "chronos — Codex CLI hooks. Drop into ~/.codex/hooks.json (user) or <repo>/.codex/hooks.json. Also add [features] codex_hooks = true to ~/.codex/config.toml. Replace ${CHRONOS_ROOT}. Note: Codex PreToolUse matches Bash only; Read/Write/Edit tool events may be unavailable until coverage extends.",
  "hooks": {
    "SessionStart": [
      { "command": "bash ${CHRONOS_ROOT}/scripts/session_start.sh" }
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High
Category
Agent Snooping
Content
{
  "_comment": "chronos — Codex CLI hooks. Drop into ~/.codex/hooks.json (user) or <repo>/.codex/hooks.json. Also add [features] codex_hooks = true to ~/.codex/config.toml. Replace ${CHRONOS_ROOT}. Note: Codex PreToolUse matches Bash only; Read/Write/Edit tool events may be unavailable until coverage extends.",
  "hooks": {
    "SessionStart": [
      { "command": "bash ${CHRONOS_ROOT}/scripts/session_start.sh" }
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High
Category
Agent Snooping
Content
mv "$TMP" "$TARGET"

# Enable feature flag
CONF="$HOME/.codex/config.toml"
[ -f "$CONF" ] || touch "$CONF"
if ! grep -q '^\s*codex_hooks\s*=\s*true' "$CONF" 2>/dev/null; then
  if ! grep -q '^\[features\]' "$CONF" 2>/dev/null; then
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Session Persistence

Medium
Category
Rogue Agent
Content
To add chronos support for a new agent platform:

1. Create `installers/<platform>/README.md` describing the platform's hook or plugin API
2. Write the context injection: SessionStart must emit `now_utc`, `now_local`, `tz`, `ledger`, `state`, `session`
3. Write per-turn injection: UserPromptSubmit must emit `turn`, `session_duration`, `since_last_user`
4. Write the ledger writer: PreToolUse appends `started_at`, PostToolUse appends `finished_at + duration_ms + success`
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## The problem

LLMs do not know what time it is. They guess. They report "just now" when it was two hours ago. They retry failed commands without checking that the last attempt was 10 seconds ago. They run silently in autonomous loops with no idle detection.

[Arxiv 2510.23853](https://arxiv.org/abs/2510.23853) measured this empirically: even frontier models with timestamps injected into context reach only **65% temporal reasoning alignment** with human judgment. Timestamps appear in fewer than 4% of reasoning traces. The ceiling exists because having access to timestamps is not enough. Agents need explicit rules for *when to look at the clock*.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The markdown explains that every session and each tool call populate ledger and state files, including per-tool timing and argument hashes, but it does not clearly warn users that this creates persistent local activity logs. Although retention settings are documented later, there is no prominent disclosure that installing the skill causes ongoing recording of agent/tool activity that may affect privacy or user data handling.

Session Persistence

Medium
Category
Rogue Agent
Content
### OpenCode

```bash
mkdir -p ~/.config/opencode/plugins
cp installers/opencode/plugin.ts ~/.config/opencode/plugins/chronos.ts
mkdir -p ~/.config/opencode/skills/chronos
cp SKILL.md ~/.config/opencode/skills/chronos/SKILL.md
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The description says the skill activates whenever an agent reasons about recency, retry windows, memory staleness, deploy cooldowns, idle detection, or any 'when / how long ago' question. This scope is expansive and lacks clear exclusion conditions, so it could cause unintended invocation for many ordinary time-related user requests.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
# path may vary by ADAL version — check docs
mkdir -p ~/.adal/skills/chronos
cp SKILL.md ~/.adal/skills/chronos/SKILL.md
cp AGENTS.md ~/.adal/skills/chronos/AGENTS.md
```
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The manifest describes chronos as providing temporal awareness through hooks and a ledger, but this installer's documented scope is primarily settings-hook installation. In uninstall mode, the script also recursively removes the whole skill directory, which is a broader destructive action than merely concatenating/removing hook configuration from Claude settings.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
In uninstall mode, the script deletes the skill directory with `rm -rf` after only showing the option in `--help`; there is no interactive confirmation or stronger runtime warning immediately before the destructive action. Because this removes local files recursively, it is a safety-relevant operation that should be clearly disclosed at execution time.

Vague Triggers

Medium
Confidence
98% confidence
Finding
This is a JSON manifest file, so vague-trigger checks apply. Each hook block uses an empty string for "matcher", which provides no specificity or constraint on when the hook should run within the event type, making invocation scope overly broad and potentially causing unintended executions.

Vague Triggers

Medium
Confidence
89% confidence
Finding
This is a manifest JSON file, so vague-trigger checks apply. Each hook entry uses an empty string for "matcher", which provides no specificity about when the hook should run beyond the broad event name, increasing the risk of unintended invocation across all matching contexts.

Session Persistence

Medium
Category
Rogue Agent
Content
## Install (project)

```bash
mkdir -p .cursor/rules
cp .cursor/rules/chronos.mdc .cursor/rules/chronos.mdc
```
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.