Security audit

定时大师

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a cron scheduling guide, but it asks for broad command, file, API, and scheduler authority that is not clearly scoped to that purpose.

Review before installing. Use it only if you are comfortable with a scheduling skill influencing cron jobs, push notifications, and local memory. Avoid granting generic shell, file, or API authority unless you can constrain it to explicit cron-related actions, and confirm before sending reminders through external channels or editing scheduler state.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The document states that the skill itself does not require an API key, but later instructs users to configure API keys for functionality. This inconsistency can cause users to enable broader credentials than expected and misjudge the trust boundary of the skill, increasing the chance of accidental secret exposure or over-privileged setup.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The skill is introduced as a pure Markdown scheduling guide, but later claims broad file handling, API integration, and command execution abilities. This is dangerous because it obscures the actual operational scope of the skill and can trick operators into approving a much more powerful capability set than the stated purpose justifies.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Command execution is a privileged capability and is not justified by the stated scheduling-guidance use case. In a Markdown skill context, presenting exec as a generic feature expands the attack surface substantially and can lead to arbitrary shell actions under the guise of routine scheduling help.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Generic file processing is unrelated to the core purpose of cron/scheduling guidance and grants broader access than users would reasonably expect. Unnecessary read/write scope can expose local data, enable unsafe file modification, or be combined with other capabilities for lateral misuse.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: External API integration is presented as a generic capability despite the skill being positioned as a scheduling guide. This widens data egress and trust boundaries, creating risk that user data or task contents could be transmitted to external services without clear necessity or expectation.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill recommends push delivery to external channels such as Telegram and includes examples with recipient identifiers, but does not clearly warn that reminder contents and metadata will leave the platform boundary. This can lead to unintended disclosure of sensitive user data through third-party messaging services.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation advises manual deletion of the cron state file in the user's home directory without a strong warning about data loss, corruption, or service interruption. Destructive operational guidance in a skill can cause users or agents to remove scheduler state unsafely and break task integrity.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The skill instructs the agent to persist timezone information in MEMORY.md, creating durable retention of user-specific data without discussing minimization, retention limits, or user consent. Even seemingly low-sensitivity profile data can become privacy-relevant when combined with schedules, routines, and other contextual history.

Static analysis

No suspicious patterns detected.