ClawHub
Back to skill

Security audit

Cron Expert Free

Security checks across malware telemetry and agentic risk

Overview

This scheduling guide is purpose-aligned and locally scoped, but users should understand its timezone and session-start behavior before relying on it.

Install only if you want an agent to manage local reminder files and possibly update them when a session starts. Review or adapt the timezone handling before relying on it for important reminders, especially outside Asia/Shanghai, because the examples do not actually store offset-aware timestamps despite claiming they do.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The skill claims timestamps are stored as ISO 8601 with timezone information, but the example code uses naive datetimes from datetime.now() and isoformat() without any offset. In a scheduling skill, this can cause reminders to fire at the wrong time when data is interpreted on systems with different local time settings or after timezone changes, undermining reliability and potentially causing missed or premature actions.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The FAQ repeats a security-relevant guarantee that all timestamps include timezone information, but the implementation does not persist any offset-aware timestamps. This mismatch can mislead users into trusting scheduling behavior that is not actually enforced, increasing the chance of incorrect execution timing and audit confusion.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs automatic self-wake checks and task execution at session start, including reading and updating local reminder state, without prominent user consent or warning. In an agent context with exec access, automatic state mutation can cause unexpected task execution, silent file changes, and unintended actions merely by opening a session.

Natural-Language Policy Violations

Medium
Confidence
87% confidence
Finding
Mandating a single timezone for all tasks without user opt-in can cause reminders and scheduled actions to execute at unintended times for users outside that region. In a scheduling skill, forced timezone assumptions materially affect integrity of execution and can lead to missed deadlines or premature actions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.