Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

cron-skills-session

v1.0.0

Standardizes OpenClaw cron job entries to always use the current user session as target. Use when creating or editing cron jobs to ensure they deliver messag...

0· 106·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for thegoaldev/cron-skills-session.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "cron-skills-session" (thegoaldev/cron-skills-session) from ClawHub.
Skill page: https://clawhub.ai/thegoaldev/cron-skills-session
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install cron-skills-session

ClawHub CLI

Package manager switcher

npx clawhub@latest install cron-skills-session
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill claims to standardize cron job entries for OpenClaw and the SKILL.md is consistent with that goal, but the package metadata lists no required binaries or config paths while the instructions require uuidgen, date, python3 (for json validation), and the openclaw gateway binary and operate on ~/.openclaw/cron/jobs.json. The missing declarations are disproportionate and make the manifest inaccurate.
!
Instruction Scope
The runtime instructions explicitly direct the agent to generate UUIDs, read and overwrite ~/.openclaw/cron/jobs.json, validate JSON, and run 'openclaw gateway restart' without asking the user to confirm edits. They also mandate always targeting 'session:agent:main:user-session' and using 'agentTurn' payloads, which gives the skill the ability to create scheduled agent-driven actions. The instructions are prescriptive and perform persistent system changes beyond simply suggesting a cron entry.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so there is no additional install-time execution risk. However, lack of install does not eliminate runtime risks from the agent following the instructions.
Credentials
No environment variables or credentials are requested in the metadata, which is appropriate. However, the instructions implicitly require access to the user's home config (~/.openclaw/cron/jobs.json) and the 'openclaw' binary to restart the gateway; those config path and binary requirements are not declared in the manifest and should have been. The requirement to always target the 'main' agent session and inject 'agentTurn' payloads is powerful and should be justified.
Persistence & Privilege
The skill does not set always:true, but it instructs the agent to create persistent scheduled jobs that will invoke the agent's main session in the future. Autonomous invocation combined with the ability to write scheduled agentTurn messages expands the blast radius if the agent is allowed to act without human confirmation. This is not disallowed by itself, but is an important risk factor to consider.
What to consider before installing
This skill will autonomously edit ~/.openclaw/cron/jobs.json and restart your OpenClaw gateway to install scheduled agent-driven tasks. Before installing or using it: 1) confirm the skill's source and trustworthiness (no homepage or known owner listed); 2) verify you have backups of ~/.openclaw/cron/jobs.json and confirm the 'openclaw' binary behavior; 3) ask the maintainer why required binaries/config paths are missing from the metadata and request that the skill require explicit user confirmation before writing or restarting the gateway; 4) consider whether you want scheduled 'agentTurn' messages that run in the main session (these can trigger future agent actions) — if unsure, do not allow autonomous execution and require human approval for each change; 5) prefer a version that offers a preview/dry-run of the JSON change and logs edits for auditing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97bw2fy4f23n525f6xw0kt5dh856fhj
106downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Cron Session Target — OpenClaw Cron Jobs

Instructions for the LLM

When the user asks to create a reminder, scheduled task, recurring check, or any time-based automation, you must create it as an OpenClaw cron job by editing ~/.openclaw/cron/jobs.json directly. Do not suggest system cron (crontab), at, or any other mechanism. The OpenClaw cron system is the only correct method.

Your exact workflow when the user requests a cron job:

  1. Run uuidgen to generate a UUID for the job
  2. Run date +%s%3N to get the current epoch timestamp in milliseconds
  3. Build the JSON entry using the required format below
  4. Read ~/.openclaw/cron/jobs.json to get the current content
  5. Insert the new job into the jobs array
  6. Write the updated file back
  7. Validate the JSON: python3 -m json.tool ~/.openclaw/cron/jobs.json > /dev/null
  8. Restart the gateway: openclaw gateway restart
  9. Confirm to the user that the job is active

Never ask the user to edit the file themselves. Always do it completely.

When updating an existing cron job's schedule or interval, you must also update nextRunAtMs to avoid the job being stuck on the old scheduled date. Compute it as:

nextRunAtMs = current_epoch_ms + new_everyMs

Run date +%s%3N to get the current time, add the new interval, and set both updatedAtMs and nextRunAtMs to these values. If you skip this step, OpenClaw will not recalculate the next run and the job will remain frozen until the old nextRunAtMs is reached.


Required JSON Format

Every job entry must follow this exact structure:

{
  "id": "<uuidgen output>",
  "agentId": "main",
  "name": "descriptive job name",
  "enabled": true,
  "deleteAfterRun": false,
  "createdAtMs": <date +%s%3N>,
  "updatedAtMs": <date +%s%3N>,
  "schedule": {
    "kind": "every",
    "everyMs": 60000,
    "anchorMs": <date +%s%3N>
  },
  "sessionTarget": "session:agent:main:user-session",
  "wakeMode": "now",
  "payload": {
    "kind": "agentTurn",
    "message": "the message text here"
  },
  "delivery": {
    "mode": "none"
  }
}

Field Reference

FieldRequiredValue
idYesUUID v4 — generate with uuidgen
agentIdYesAlways "main"
nameYesShort human-readable label
enabledYestrue to activate immediately
deleteAfterRunYesAlways false for recurring jobs
createdAtMsYesCurrent time — date +%s%3N
updatedAtMsYesCurrent time — date +%s%3N
schedule.kindYes"every" for recurring, "at" for one-shot
schedule.everyMsYes (kind=every)Interval in milliseconds
schedule.atMsYes (kind=at)Exact epoch ms timestamp to run once
schedule.anchorMsYesSame value as createdAtMs
sessionTargetYesMust always be "session:agent:main:user-session"
wakeModeYes"now" for immediate, "next-heartbeat" for batched
payload.kindYesAlways "agentTurn"
payload.messageYesThe message sent to the agent session
delivery.modeYes"none" unless broadcasting to a channel

Interval Reference

DescriptioneveryMs value
Every 1 minute60000
Every 5 minutes300000
Every 15 minutes900000
Every 30 minutes1800000
Every 1 hour3600000
Every 2 hours7200000
Every 6 hours21600000
Every 12 hours43200000
Every 24 hours (daily)86400000
Every 7 days (weekly)604800000

Examples

1. Water reminder — every 30 minutes

{
  "id": "52be6125-16cd-4aec-9508-9e8355f10f54",
  "agentId": "main",
  "name": "water reminder",
  "enabled": true,
  "deleteAfterRun": false,
  "createdAtMs": 1775801246492,
  "updatedAtMs": 1775801246492,
  "schedule": {
    "kind": "every",
    "everyMs": 1800000,
    "anchorMs": 1775801246492
  },
  "sessionTarget": "session:agent:main:user-session",
  "wakeMode": "now",
  "payload": {
    "kind": "agentTurn",
    "message": "💧 Water break! Remind the user to drink water."
  },
  "delivery": {
    "mode": "none"
  }
}

2. Daily standup — every 24 hours

{
  "id": "a1b2c3d4-0000-4aec-9508-aabbccddeeff",
  "agentId": "main",
  "name": "daily standup",
  "enabled": true,
  "deleteAfterRun": false,
  "createdAtMs": 1775801246492,
  "updatedAtMs": 1775801246492,
  "schedule": {
    "kind": "every",
    "everyMs": 86400000,
    "anchorMs": 1775801246492
  },
  "sessionTarget": "session:agent:main:user-session",
  "wakeMode": "now",
  "payload": {
    "kind": "agentTurn",
    "message": "Good morning! Ask the user what they are working on today and what blockers they have."
  },
  "delivery": {
    "mode": "none"
  }
}

3. Posture check — every 1 hour

{
  "id": "f9e8d7c6-1111-4bcd-8ef0-112233445566",
  "agentId": "main",
  "name": "posture check",
  "enabled": true,
  "deleteAfterRun": false,
  "createdAtMs": 1775801246492,
  "updatedAtMs": 1775801246492,
  "schedule": {
    "kind": "every",
    "everyMs": 3600000,
    "anchorMs": 1775801246492
  },
  "sessionTarget": "session:agent:main:user-session",
  "wakeMode": "now",
  "payload": {
    "kind": "agentTurn",
    "message": "🪑 Posture check! Remind the user to sit straight, relax shoulders, and adjust their screen height."
  },
  "delivery": {
    "mode": "none"
  }
}

4. Weekly review — every 7 days

{
  "id": "c0ffee00-2222-4abc-9999-deadbeef1234",
  "agentId": "main",
  "name": "weekly review",
  "enabled": true,
  "deleteAfterRun": false,
  "createdAtMs": 1775801246492,
  "updatedAtMs": 1775801246492,
  "schedule": {
    "kind": "every",
    "everyMs": 604800000,
    "anchorMs": 1775801246492
  },
  "sessionTarget": "session:agent:main:user-session",
  "wakeMode": "now",
  "payload": {
    "kind": "agentTurn",
    "message": "📋 Weekly review time! Ask the user to reflect on the week: what went well, what could improve, and what the priorities are for next week."
  },
  "delivery": {
    "mode": "none"
  }
}

5. One-shot scheduled task — run once at a specific time

Use "kind": "at" with an exact epoch ms timestamp instead of everyMs:

{
  "id": "deadbeef-3333-4cde-aaaa-111122223333",
  "agentId": "main",
  "name": "meeting reminder",
  "enabled": true,
  "deleteAfterRun": true,
  "createdAtMs": 1775801246492,
  "updatedAtMs": 1775801246492,
  "schedule": {
    "kind": "at",
    "atMs": 1775830000000,
    "anchorMs": 1775801246492
  },
  "sessionTarget": "session:agent:main:user-session",
  "wakeMode": "now",
  "payload": {
    "kind": "agentTurn",
    "message": "⏰ Meeting in 5 minutes! Remind the user to wrap up and join the call."
  },
  "delivery": {
    "mode": "none"
  }
}

For one-shot jobs, deleteAfterRun can be true since the job should not repeat.


Step-by-Step Creation

# Step 1 — generate a unique ID
uuidgen

# Step 2 — get current timestamp in milliseconds
date +%s%3N

# Step 3 — edit the jobs file
# Insert the new entry in the "jobs" array

# Step 4 — validate JSON syntax
python3 -m json.tool ~/.openclaw/cron/jobs.json > /dev/null

# Step 5 — reload
openclaw gateway restart

Common Pitfalls

MistakeEffectFix
sessionTarget not set or wrongMessage is lost or goes nowhereAlways use "session:agent:main:user-session"
"text" instead of "message" in payloadJob fires but nothing arrivesUse "message"
deleteAfterRun: true on recurring jobJob vanishes after first runSet to false
Wrong ms mathJob runs at wrong intervalUse the interval reference table above
Trailing comma in JSONEntire jobs file fails to parseValidate with python3 -m json.tool
enabled: falseJob never runsSet to true
Updating interval without updating nextRunAtMsJob stays frozen on old scheduled dateSet nextRunAtMs = date +%s%3N + new_everyMs

Quick Reference

sessionTarget  →  "session:agent:main:user-session"   (never change this)
payload field  →  "message"                            (not "text")
recurring      →  "deleteAfterRun": false
one-shot       →  "deleteAfterRun": true, "kind": "at"
after editing  →  openclaw gateway restart
update timing  →  always set nextRunAtMs = now_ms + everyMs when changing schedule

Comments

Loading comments...