Security audit

定时大师

Security checks for vulnerabilities and agentic risk

Overview

This scheduling guide is mostly coherent, but it includes high-impact examples that could send reminders to a fixed Telegram recipient or route broad cleanup actions through a privileged main session.

Review this skill before installing in any environment with real notification or cron-management privileges. Replace the hardcoded Telegram recipient with verified user-specific routing, avoid privileged main-session cleanup jobs unless deletion scope is enforced by the platform, and treat the generic file/API/exec claims as overbroad unless separately justified.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:69
Finding: Hardcoded Telegram Recipient Can Redirect User Reminder Content
Content: View full analysis
Remediation: View remediation
" } ``` 2. Resolve recipients exclusively from an authenticated platform-level mapping between the current user and their verified messaging account. 3. Require explicit user confirmation before first-time delivery to a new channel or recipient. 4. Reject numeric recipient values copied from Skill documentation unless they match the authenticated user's verified configuration. 5. Display the resolved channel and masked recipient before creating the scheduled job. 6. Add server-side authorization checks so an agent cannot send to arbitrary account identifiers merely by changing `delivery.to`. 7. Use clearly synthetic values in all documentation and tests, and add automated checks that reject real-looking hardcoded messaging identifiers. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:210
Finding: Scheduled Main-Session Injection Bypasses Isolation for Broad Task Deletion
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is introduced as a Markdown decision guide for scheduling, but later claims operational file processing, API integration, and command execution. That mismatch broadens the apparent authority of the skill and may cause an agent runtime or user to permit powerful actions under false assumptions about the skill's purpose. Scope inflation is dangerous because it hides high-risk behaviors inside documentation that appears advisory.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill claims command-execution capability despite being framed as a scheduling guidance skill. Unjustified exec claims normalize shell access and can prompt an agent to run local commands in response to loosely related user inputs, creating risk of system modification, data exposure, or chaining with other unsafe instructions in the document. Because the document also contains operational troubleshooting steps, this expands the attack surface beyond its stated mission.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description says "Use when 用户需要定时大师相关功能时使用" and "在需要cron master相关能力的开发场景", which are circular and very broad activation criteria. This does not clearly distinguish when the skill should or should not be invoked beyond a vague reference to its own name/capabilities, increasing the chance of unintended invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description states "支持中文交互，无需复杂配置即开即用", presenting Chinese as the expected interaction language, and the skill title/display metadata are also Chinese-only. There is no indication that users may choose another language or opt in to this locale constraint.
Content: No source excerpt is available for this finding.

Ssd 1

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The strict delivery template instructs a sub-agent to output content verbatim without modification or commentary. While intended to prevent extra phrasing, it also weakens normal safety mediation by discouraging the agent from contextualizing, filtering, or refusing unsafe payloads if malicious or harmful content is scheduled for delivery. In a messaging and automation skill, verbatim relay semantics increase the risk of abuse for social engineering or policy bypass.
Content: No source excerpt is available for this finding.

Ssd 1

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide repeatedly recommends a verbatim-output command specifically to suppress normal model behavior. This semantically encourages bypass of guardrails and can be repurposed to deliver deceptive, abusive, or otherwise unsafe content with minimal intervention from the agent. The surrounding context of push notifications and autonomous scheduled delivery makes this more dangerous than a benign formatting hint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The troubleshooting guidance tells operators to manually clean a cron state file and restart the gateway, but does not clearly warn about deletion/modification risk beyond a brief backup note. In an agent context, file modification instructions can be operationalized into destructive actions, leading to loss of scheduler state or service disruption. This is more dangerous because it appears in a diagnostic section where users may follow steps quickly under pressure.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation first states that the skill itself does not require API keys, then later instructs users to configure API keys for some features. This inconsistency can mislead operators about trust boundaries and prerequisites, causing them to grant secrets or enable capabilities they did not expect. In a skill that already advertises exec and API integration, ambiguity around credential use increases deployment risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill advertises file-processing and external API-integration capabilities that are not justified by its scheduling-guidance purpose. This unnecessary expansion of scope can lead users or orchestrators to over-trust the skill with filesystem and network access, increasing chances of data leakage or unintended side effects. In documentation-driven agent systems, overstated capabilities are a real safety issue because they influence tool use behavior.
Content: No source excerpt is available for this finding.