T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:124- Finding
Concurrent Reminder Operations Can Corrupt or Overwrite Persistent State
- Content
View full analysis
- Remediation
View remediation
Security audit
Cron Expert Free
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed local reminder/scheduling guide that writes reminder state locally, with reliability issues but no evidence of deception, exfiltration, or destructive behavior.
Install only if you are comfortable with a skill that may read and update a local reminder JSON file at agent session start. Treat it as a lightweight local reminder guide, not a robust scheduler: review timezone behavior, avoid concurrent agent sessions using the same reminder file, and do not rely on it for critical deadlines without adding locking and timezone-aware timestamps.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:113- Finding
Declared Asia/Shanghai Timezone Lock Is Not Enforced
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The scope keywords are excessively broad and include generic trigger terms such as 'Use', 'when', 'LLM', and wide descriptive phrases, which can cause accidental invocation outside the intended scheduling context. In an agent environment with exec capability, unintended activation increases the chance of autonomous file reads/writes and reminder execution when the user did not explicitly ask for it.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill describes automatic session-start checking and execution of tasks, including local file access and state updates, without clear up-front warning or consent. Autonomous behavior at conversation start is dangerous because it can perform actions and mutate local data before the user understands that the skill is active.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The timezone policy says all tasks use "Asia/Shanghai," which imposes a specific locale setting on all users. The document does not offer opt-in, per-user configuration, or a clear region-specific justification for forcing that timezone universally.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document promises ISO 8601 timestamps with timezone information, but the code uses naive local datetimes via datetime.now().isoformat() and datetime.fromisoformat() on values without offsets. This can cause reminders to run at the wrong wall-clock time when moved across environments, interpreted by different agents, or during timezone changes, undermining scheduling correctness and auditability.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The FAQ repeats that all timestamps include timezone information, but the implementation stores naive timestamps. This misleading guidance increases the chance that users rely on incorrect assumptions in multi-host or cross-timezone use, leading to silent misexecution of scheduled tasks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The document states "完全中文化表达，适配中文用户工作流," indicating the skill is intentionally localized to Chinese-only usage. There is no accompanying user choice, opt-in, or justification that this locale restriction is required for a region-specific compliance purpose.
- Content