Security audit

cron优秀实践专家(专业版)

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly a cron scheduling guide, but it asks for broad agent powers and includes persistent, mutating examples plus unsupported credential, callback, and command-safety claims.

Install only if you intend to use it as an operational cron-scheduling assistant, and review any generated code before running it. Do not provide API keys or callback URLs unless you have a separate trusted integration path, and require explicit confirmation before it writes scheduler files, imports crontab commands, runs shell commands, or archives tasks.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is presented as a best-practices guide, but the embedded examples create directories under the user's home workspace and write persistent job, lock, and audit files. In an agent context, documentation that appears advisory but includes state-mutating code can cause unintended filesystem changes and persistent side effects when reused or copied into execution flows.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill claims a constrained cron-expert scope, yet its documentation also introduces callback URLs, API-key requirements, and HTTPS/network concepts that are not necessary for the stated function and are not implemented consistently. This scope inflation can mislead an agent into enabling broader capabilities than users expect, increasing the chance of unauthorized network handling or credential collection patterns.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Documenting a callback_url implies outbound network communication for asynchronous notification, but that behavior is not justified by a cron best-practices advisory skill. In agent ecosystems, merely advertising callback support can prompt collection and later use of attacker-controlled URLs, creating SSRF, data exfiltration, or trust-boundary confusion risks.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The documentation tells users that some features require API keys and that command-style execution may be needed, despite the skill being framed as a cron expert guide rather than an integration or execution tool. This can normalize unnecessary credential entry and command execution expectations, broadening the attack surface and confusing users about what the skill should be allowed to do.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The security section claims command execution is restricted by a whitelist, but no such enforcement exists in the shown code, and migration logic preserves arbitrary command strings from crontab entries. This mismatch is dangerous because users and agents may trust that imported commands are constrained when they are not, enabling later unsafe execution of attacker-supplied commands.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The activation wording is broad enough that the skill could be invoked for loosely related scheduling, automation, or operational tasks outside its safe intended scope. Over-broad triggers are risky in agent systems because they can route users into a skill that has write and bash capabilities, increasing the chance of unintended side effects or privilege misuse.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The supported scenario keywords are highly ambiguous and expansive, which can cause the platform to over-select this skill for general enterprise or scheduling conversations. Because the skill advertises write/bash tools and mutating workflows, over-triggering raises the risk of accidental invocation in contexts where users only wanted advice, not operational changes.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill describes automatic archival cleanup as a maintenance feature but does not prominently warn that it modifies persisted task state by changing statuses and writing the results back to disk. In practice, users may treat this as read-only guidance and unintentionally archive production tasks or alter records without informed consent.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: Hard-coding the timezone to Asia/Shanghai forces locale-specific behavior without user choice, which can silently alter scheduling semantics for deployments in other regions. In scheduling systems this can lead to missed, duplicated, or mistimed jobs, especially during migrations or cross-region operations.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.