ClawHub
Back to skill

Security audit

Agent Cron Service

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed SettleMesh scheduling helper for hosted recurring agents, with billing and authentication risks that fit its stated purpose.

Install this only if you want an agent to use your SettleMesh account for hosted recurring work. Review any browser login prompt before approving it, prefer a scoped API key if available, set per-fire and per-day caps, and pause or delete schedules you no longer want billed.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill explicitly tells the agent to autonomously run `settlemesh login`, open a browser, and drive an approval flow if authentication is missing. That expands behavior from simple cron setup into initiating an authenticated session on the user's behalf, which can surprise the user, trigger external side effects, and normalize credential or consent flows without an explicit just-in-time confirmation. In a billing-enabled platform context, automatic auth bootstrapping is more dangerous because it is a prerequisite to creating scheduled jobs that can incur recurring charges.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The description casts a very wide net over cron jobs, scheduled tasks, recurring tasks, background jobs, digests, monitors, reports, and anything stateful that survives a turn. This can cause the skill to activate in situations where the user did not specifically ask to use this third-party hosted service, increasing the chance of unintended network calls, account usage, agent deployment, and recurring billed schedules. Because this skill creates durable, externally hosted jobs, overbroad triggering is more risky than in a read-only or local-only skill.

Static analysis

No suspicious patterns detected.