Security audit

Cron Mate Free

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a cron expression helper, not malware, though its documentation is sloppy about activation scope and local-versus-LLM processing.

Install only if you want a Chinese-language cron helper. Treat schedule text as potentially visible to the host agent/LLM despite the local-only wording, and be aware the broad translation keywords may make the skill activate for non-cron translation requests.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: SQP-3适用于所有文件。文档在L250-L259明确规定“中文翻译”，且多处将能力定义为中文输入转cron、cron转中文描述，未说明是否支持用户选择其他语言；同时L374强调“完全中文化表达”，体现了固定语言约束而非用户可选语言。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger scope includes broad, unrelated keywords such as generic translation and localization use cases, which can cause the skill to activate outside its cron-specific purpose. Over-broad invocation increases the chance the agent will route unrelated user content into this skill, potentially mishandling data, confusing workflows, or causing unnecessary tool use including exec-enabled paths.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill makes contradictory trust and privacy claims: it says parsing is fully local and does not involve cloud calls, while also declaring an LLM API dependency and a GPT-4o-mini routing path. This can mislead users and operators about data handling boundaries, causing them to provide sensitive schedules or operational details under false assumptions about locality and exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file consistently describes the skill as producing Chinese-only validation messages and translations, including the class docstring and all returned user-facing strings. Because the file provides no opt-in, language selection, or justification for a China-specific scope, it appears to impose a locale/language policy unconditionally.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: 代码注释和示例表明该技能会把 cron 表达式翻译为中文描述，但这里用 w in weekday_names 检查字符串字段是否存在于以整数为键的字典中，条件永远不会按预期匹配。结果如 L160 所示的 0 8 * * 1-5 还能命中前一分支，但单个周值如 1 不会被翻译成“周一”，而会落入更笼统的“星期1”，与“翻译为中文描述”的实现意图不一致。
Content: No source excerpt is available for this finding.