cron表达式助手(专业版)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:59 AM UTC
• Version: 1.0.0

Overview

This cron helper does not show malware, but it asks for broad file and shell powers and documents network, callback, and admin/exec behavior that do not fit a cron-expression assistant.

Review before installing. Treat this as a cron expression reference/helper only, and do not grant Bash, broad file write/edit access, callback URLs, or administrator privileges unless the publisher narrows the permissions and removes unsupported command/network claims. No direct malware, persistence, or data theft was found in the inspected artifact.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:10

Finding

Excessive Filesystem and Shell Permissions for Cron Expression Processing

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-13; related privilege-escalation guidance at line 476
Vulnerability Type: Violation of least privilege
Risk Level: Medium

Complete Code Snippet:

yaml

tools:
  - Read
  - Write
  - Edit
  - Bash

Line 476 additionally advises users experiencing permission errors to check file permissions and run with administrator privileges.

Technical Analysis

The Skill's declared functionality consists of parsing, translating, validating, optimizing, previewing, and converting cron expressions. These operations are primarily deterministic text and date calculations. They do not inherently require arbitrary shell execution or unrestricted modification of project and system files.

Declaring Write, Edit, and Bash therefore grants capabilities beyond the minimum privileges needed for the stated task. The generic recommendation to run with administrator privileges can further increase the impact of an unsafe or mistakenly generated tool call. The document does not define a specific privileged operation, restrict writable paths, provide a command allowlist, or require explicit user approval before shell execution.

The permissions alone do not prove malicious execution, and the audited file contains no command that installs a cron job. However, broad tools create an avoidable security boundary violation if untrusted cron input or contextual instructions influence the agent's actions.

Attack Path

1. A user or untrusted document supplies a crafted request while this Skill is active.
2. The request persuades the agent that it must inspect files, modify scheduler configuration, or invoke a shell to process or migrate the cron expression.
3. Because the Skill declares Read, Write, Edit, and Bash, the agent may access files or execute commands unrelated to expression analysis.
4. If the operator follows the line 476 recommendation to r ...[truncated 1019 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Write, Edit, and Bash from the declared tools. Retain Read only if the Skill must load cron expressions from existing files; otherwise, remove it as well.
2. Implement expression parsing, validation, timezone handling, and format conversion without invoking external commands.
3. Remove the generic recommendation to run as administrator. Privilege errors should instead result in a safe failure with an explanation of the narrowly required access.
4. If file export is a required feature, use a dedicated, path-scoped write capability restricted to a user-selected output file.
5. If shell execution is introduced for a documented feature, require explicit per-command user approval, use a strict command and argument allowlist, reject shell metacharacters, and execute under an unprivileged account.
6. Explicitly state that the Skill converts cron expressions but does not install crontab entries, create scheduled tasks, or register services unless the user separately requests and approves that operation.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The description includes an overly broad invocation cue for AI models, intelligent dialogue, agent orchestration, and LLM applications that is unrelated to a cron-expression helper. This broadens the situations in which the skill may be selected, increasing the chance that a high-privilege skill with Bash/Write/Edit tools is invoked outside its intended domain and used as a stepping stone for unrelated actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill's display name, summary, description, and body are presented entirely in Chinese, with no indication that users may choose another language. This creates a locale/language policy concern because the skill appears to assume a specific language by default rather than offering user choice or documenting a justified regional restriction.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill presents callback URL and network-related behavior that is not supported by the shown cron-processing logic, creating a capability mismatch between declared interface and actual implementation. In an agent environment, this can mislead orchestration layers or users into supplying external endpoints or trusting hidden side effects, which expands perceived privileges and can enable unsafe integrations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The FAQ and error-handling sections normalize command execution, file operations, exec capability, and network troubleshooting even though the cron helper code shown does not require them. In context, this is risky because the manifest requests powerful tools, so unrelated operational guidance can prime an agent or user to invoke unnecessary high-risk capabilities.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation asserts command-execution safety controls and HTTPS protections for behaviors that are not implemented anywhere in the provided skill code. False security assurances are dangerous because operators may rely on nonexistent safeguards when granting tools like Bash, Read, Write, and Edit, leading to misplaced trust and weaker review of actual runtime behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.