Phy Cron Explainer

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:54 PM UTC
• Version: 1.0.3

Overview

The skill mostly matches its cron-explainer purpose, but it can silently install an unpinned Python package at runtime despite claiming pure local parsing.

Review this skill before installing if your agent runs with network access or a writable shared Python environment. The cron analysis and project scanning behavior are purpose-aligned and local/read-only, but the next-run calculation may silently alter the environment by installing croniter. Prefer a version that declares dependencies up front, pins them, or fails with a clear setup instruction instead of auto-installing packages.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:402

Finding

Automatic Runtime Installation of an Unpinned Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 402–419
Vulnerability Type: Supply-chain exposure through automatic dependency installation
Risk Level: Medium

Complete Code Snippet:

python

def next_runs(expression: str, count: int = 5, after: Optional[datetime] = None) -> list[datetime]:
    """
    Calculate the next N run times for a cron expression.
    Uses croniter if available, otherwise falls back to manual calculation.
    """
    after = after or datetime.now(tz=timezone.utc)

    try:
        from croniter import croniter
        cron = croniter(expression, after)
        return [cron.get_next(datetime) for _ in range(count)]
    except ImportError:
        pass

    # Fallback: install croniter
    import subprocess
    subprocess.run(['pip', 'install', 'croniter', '-q'], check=True)
    from croniter import croniter
    cron = croniter(expression, after)
    return [cron.get_next(datetime) for _ in range(count)]

Technical Analysis

When croniter is unavailable, the function automatically invokes pip install croniter at runtime. The dependency is not pinned to a reviewed version, no package hash is verified, and installation is not isolated or subject to explicit user approval.

Package resolution depends on the environment's active pip configuration and package indexes. Therefore, a compromised package release, package repository, mirror, DNS/network path, or pip configuration could supply malicious installation content. Python package installation may execute build-system or setup code, resulting in code execution during installation.

This behavior also conflicts with the Skill's claim of “Zero external API — pure local parsing,” because it can initiate network access and alter the Python environment. It exceeds the minimum privileges needed to explain cron expressions: next-run calculation should use a predeclared dependency or fail safely rather th ...[truncated 1377 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the runtime subprocess.run(['pip', 'install', ...]) operation.
2. Declare croniter as an explicit project dependency and pin it to a reviewed version.
3. Use lock files or hash-verified dependency installation, such as pip's --require-hashes, to ensure package integrity.
4. Install dependencies only during an explicit setup phase in an isolated virtual environment or container.
5. If croniter is unavailable, return a clear dependency error instead of modifying the environment.
6. If zero-dependency operation is required, implement and test a genuinely local next-run calculator rather than downloading code.
7. Document any required network access and obtain explicit user approval before dependency installation.
8. Run the Skill with least privilege and restrict filesystem, credential, and network access to reduce supply-chain compromise impact.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises 'Zero external API — pure local parsing,' which suggests non-invasive local behavior, but the code can still mutate the host by invoking pip install at runtime. That mismatch is dangerous because users may grant trust based on the stated local-only behavior while the skill actually performs networked dependency retrieval and environment modification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The function claims to use a local/manual fallback, but instead performs a runtime pip install and imports the newly installed package. Installing dependencies during execution changes the environment, introduces supply-chain risk, and can execute unreviewed package-install hooks or unexpected code paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code automatically runs subprocess.run(['pip', 'install', 'croniter', '-q'], check=True) without warning or consent. Silent package installation can trigger network access, alter the Python environment, and expose the system to dependency confusion or malicious package/update risks, especially in automation or privileged execution contexts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.