ClawHub
Back to skill

Security audit

Cron Scheduler Local

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local schedule manager that stores job data on the user's machine and does not show hidden network, privilege, or destructive behavior.

Install only if you want a local JSON-backed schedule manager. Specify the timezone explicitly when adding jobs, and review any create, pause, or resume action before allowing it because the skill persists schedule state under your OpenClaw memory directory.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The code is aligned with part of the declared scheduling purpose: it is local-only and computes upcoming execution times for recurring schedules (daily, weekly, monthly, interval). However, the description claims broader capabilities that are not present in the supplied code. There is no natural-language schedule parsing except fixed HH:MM parsing, no pause/resume functionality, no persistence or schedule-engine management, and no enumeration of upcoming executions beyond a single next-run calculation. This is a description-to-behavior mismatch due to overstated capabilities, even though the core domain of recurring scheduling is related.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises local file-backed behavior and explicitly names writable storage paths, but it does not declare any tool scope or permissions boundaries. That creates an authorization transparency gap: an agent may invoke file read/write capabilities broader than users or orchestrators expect, increasing the chance of unintended local file access or modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The invocation guidance is very broad, telling the system to use this skill whenever users mention timing, repetition, future triggers, or wanting to know what runs next. Over-broad routing can cause the skill to activate in contexts the user did not intend, which is more concerning here because the skill is associated with local file read/write state and could create, modify, or inspect schedules unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script assigns a default timezone of "Asia/Tokyo", which imposes a locale-specific setting whenever the user does not explicitly provide one. This is a natural-language/policy concern because it silently biases scheduling behavior toward a specific region without opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.