ClawHub
Back to skill

Security audit

Cron Delivery Fix

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real cron repair tool, but its bulk scripts can persistently rewrite scheduled message delivery targets without enough review or confirmation.

Review before installing. Do not run fix-all.sh until you have replaced the hard-coded channel, recipient, and account values with your intended values, exported or otherwise backed up existing cron configuration, and checked exactly which jobs will be changed. Prefer diagnose.sh first and use single-job repair where possible.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill instructs the operator to run shell scripts (`diagnose.sh`, `fix-single.sh`, `fix-all.sh`, `restore.sh`) but does not declare any permissions for shell access. Undeclared execution capability is a real security issue because it hides the skill's operational power from reviewers and policy enforcement, making it easier for harmful or overly-privileged behavior to slip through unnoticed.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The script is presented as a delivery-failure repair tool, but it also bulk-changes job session behavior by forcing certain jobs from main to isolated. That is a real security and operational risk because session targeting can affect privilege scope, context sharing, and task behavior, so mass-changing it based on heuristics can silently alter unrelated jobs beyond the stated purpose.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The comment says only jobs that were already announce or had no mode would default to announce, but the code actually converts nearly every non-'announce' and non-'none' mode into announce. In a cron delivery repair skill, that is dangerous because it can unintentionally enable message delivery for jobs that were configured differently, causing unauthorized notifications, data leakage, or behavior changes at scale.

Static analysis

No suspicious patterns detected.