Security audit

定时守护

Security checks for vulnerabilities and agentic risk

Overview

This cron reliability skill has no embedded executable payload, but it asks for command/file authority while giving inconsistent and overbroad instructions about API keys, external services, and execution mode.

Review before installing. Use it only for cron or scheduled-script reliability work, require explicit confirmation before it writes files or runs commands, and do not provide API keys unless the specific script you are guarding truly needs them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 70% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
md
|:-----|:-----|:-----| | `unexpected EOF` | `$(..)`未闭合或`bash -lc`嵌套引号断裂 | 把多行shell替换为脚本,cron只跑`python3 tools/<job>.py` | | 本地能跑cron里失败 | cwd不同、PATH不同、环境变量缺失 | 脚本内`cd`到仓库、显式设置PATH、文档化并校验环境变量 | | `git push`被拒(non-fast-forward) | 远程有新提交,本地推送冲突 | fetch后rebase再推送;禁止`git push --force` | | 临时文件残留导致冲突 | 脚本中断后临时文件未清理 | 用`trap 'rm -f "$TMPFILE"' EXIT`确保退出时清理 | | 周期任务重叠数据冲突 | 上一轮未跑完下一轮就启动 | 用`flock -n`文件锁防并发,获取不到锁则静默跳过 |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The display name, summary, and description are all written in Chinese, and the remainder of the skill instructions continue in Chinese without any indication that the user can choose another language. This constitutes a language/locale policy issue because the skill appears to impose a specific language by default rather than offering opt-in or documenting a region-specific limitation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill advertises command execution, file writes, and external API use, but the main usage guidance does not prominently warn users that these are impactful operations. In an agent context, weak disclosure can lead to users invoking the skill without realizing it may modify files, execute shell commands, or contact external systems.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation states the skill does not require an API key, then later says API keys are required for some functionality. This inconsistency can cause unsafe deployment assumptions, lead users to provide secrets unnecessarily, or hide when external services and secret handling are actually involved.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file alternates between describing the skill as Markdown+exec and as pure Markdown-only guidance. That execution-model confusion is security-relevant because users and host agents may misjudge whether the skill can run commands, write files, or only provide advice, undermining consent and sandbox expectations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest positions the skill as a narrowly scoped cron/job reliability guardrail, but later sections expand it into generic automation, file processing, API integration, and information retrieval. Scope drift is dangerous because it broadens operator expectations and may justify actions far beyond the reviewed purpose, increasing the chance of unintended command execution, data access, or network use.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: A skill intended for cron/script reliability guidance does not inherently need to provide API integration capability. L255, along with surrounding setup and troubleshooting content for API credentials and network/API failures, adds a capability outside the stated purpose of guarding shell scripts against cron-specific failure modes.
Content: No source excerpt is available for this finding.