ClawHub
Back to skill

Security audit

Cron Management

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed cron-job management helper with powerful but user-invoked controls for pausing, resuming, inspecting, and maintenance mode.

Install only if you intend to manage OpenClaw cron jobs from this helper. Be careful with pause-all and resume-all: resume-all can enable every disabled job, including jobs that may have been intentionally disabled before maintenance. Use list or status first, and prefer single-job commands when the target is important.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
This is a mismatch because the code includes capabilities beyond the declared description. While most behavior aligns with cron-job management, the script also supports bulk pause/resume of all jobs and a separate 'show' command for detailed job inspection, neither of which is mentioned. In addition, its maintenance mode is implemented by manipulating a local file in /tmp rather than purely managing OpenClaw cron state, which is a resource access detail that is not reflected in the description. The primary purpose is close to the declared one, but the undeclared bulk-control and filesystem-based maintenance behavior are enough to flag a mismatch under the stated criteria.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
;;
    off)
      if [ -f /tmp/cron-paused ]; then
        rm /tmp/cron-paused
        success "Maintenance mode DISABLED — jobs will run normally"
      else
        warn "Maintenance mode was not active"
Confidence
95% confidence
Finding
rm /tmp/

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.