Cron 精确调度

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:34 AM UTC
• Version: 1.0.1

Overview

This reminder skill is mostly purpose-aligned, but it gives the agent broad scheduling, memory, file, and external-message authority without enough user control or safety boundaries.

Install only if you are comfortable with this skill creating persistent scheduled tasks, sending reminder content to configured enterprise messaging platforms, and writing timezone data into agent memory. Before use, require explicit confirmation for each schedule, destination, and recipient; avoid following the state-file deletion recovery steps unless an administrator has verified backups and the exact affected path.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:34

Finding

Overbroad Forced Skill Activation and Tool-Selection Override

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34-37
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

markdown

**Mandatory activation rules:**
- When the user mentions any keyword such as "cron," "scheduled," "reminder," or "scheduling," prioritize this skill.
- When the delay described by the user exceeds one minute, prohibit the use of `act:wait` and require cron instead.
- When the user requests a specific time, daily execution, weekly execution, or similar scheduling, enter cron mode by default.

Technical Analysis

The skill claims priority whenever broad and potentially ambiguous scheduling-related keywords appear. It also prohibits an alternative tool and requires cron for delays longer than one minute. These instructions modify the Agent's general skill-selection and tool-selection behavior instead of limiting themselves to cases where the user has clearly requested creation of a persistent scheduled task.

The forced activation rules can override context-sensitive decision-making. A request that merely discusses cron, reminders, or scheduling could activate the skill even when the user only wants documentation, troubleshooting advice, or a comparison of approaches.

Attack Path

1. The skill is loaded into the Agent's active instruction context.
2. A user request contains one of the broad trigger words, including a request that does not authorize task creation.
3. The mandatory activation rule gives this skill priority.
4. The instruction prohibiting act:wait constrains normal tool selection.
5. The Agent may enter cron mode or create a scheduled task without sufficiently validating the user's actual intent.

Impact Assessment

The issue can redirect the current Agent session and cause inappropriate use of scheduler functionality. If task creation is available, the resulting scope includes persistent Agent-platform jobs, futur ...[truncated 163 chars]

Remediation

View remediation

Remediation Suggestions

• Replace mandatory activation and prohibition language with conditional recommendations.
• Distinguish task creation from informational, diagnostic, and hypothetical requests.
• Require explicit user authorization before creating any one-time or recurring scheduled task.
• Preserve higher-priority Agent policies and allow the Agent to choose the safest suitable tool.
• Confirm the schedule, timezone, target channel, recipient, recurrence, and deletion behavior before task creation.
• Use language such as: “Use cron when the user explicitly requests asynchronous scheduling and confirms the task parameters.”

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:122

Finding

Mandatory Persistent Storage of User Timezone in Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 122
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: Medium

Vulnerable Code

markdown

- **Action:** Write the user's timezone to `MEMORY.md`, for example `Asia/Shanghai`.

Related mandatory persistence instructions also appear at lines 140, 186, and 210.

Technical Analysis

The skill requires the Agent to write a user-supplied timezone into persistent MEMORY.md state. A timezone is relevant to scheduling, but global long-term Agent memory is broader than the minimum storage scope needed to execute a specific reminder. A task-local timezone or an explicitly consented user preference would provide the required functionality with less persistent state modification.

Because the value originates from user interaction, insufficient validation could also allow malformed or instruction-like content to be written into a file later consumed as Agent memory. The document does not define a strict timezone allowlist, a safe serialization format, retention limits, or a procedure for removing the stored value.

Attack Path

1. A scheduling request causes the skill to ask for a timezone.
2. The user supplies a timezone value or crafted text in the timezone field.
3. The skill writes that value into MEMORY.md.
4. The persistent memory file remains available to future Agent sessions.
5. Future scheduling decisions may consume the persisted value, causing incorrect scheduling or, where memory content is interpreted as instructions, unintended behavioral influence.

Impact Assessment

The direct scope is persistent Agent state across future sessions. A legitimate timezone value can affect all later schedules that rely on the shared memory. A malformed value could cause incorrect execution times, failed reminders, or contamination of the memory file. No evidence shows that this instruction independently grants operating-system privileges ...[truncated 29 chars]

Remediation

View remediation

Remediation Suggestions

• Store timezone information in the individual scheduled task rather than global Agent memory.
• If a persistent user preference is desirable, obtain explicit consent and explain its retention scope.
• Accept only canonical IANA timezone identifiers from a strict allowlist or validated timezone database.
• Serialize the value as structured data rather than inserting free-form text into an instruction-bearing Markdown file.
• Add expiry, update, and deletion controls for persisted timezone preferences.
• Treat existing memory content as untrusted data and prevent it from being interpreted as higher-priority instructions.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:138

Finding

Destructive Scheduler Recovery Can Delete Unrelated Jobs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 138-144
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code

markdown

| **ERR-002** | Gateway timeout | The task list is too large or the state file is damaged | 1. Back up and delete `~/.skill-platform/state/cron/jobs.json`; 2. Restart the Agent platform; 3. Recreate required tasks |

A similar recovery procedure at line 144 instructs the operator to stop the platform, back up and delete the state file, restart the platform, and rebuild critical jobs.

Technical Analysis

The recovery process treats gateway timeout or suspected corruption as sufficient justification to delete the scheduler's complete shared state file. A timeout does not by itself establish state-file corruption. The instructions do not require integrity verification, confirmation of the resolved path, validation of the backup, explicit user approval, or use of an official repair interface.

Deleting jobs.json can remove unrelated one-time and recurring tasks belonging to the same Agent platform. Restarting the platform additionally creates an availability impact. Although the procedure mentions making a backup, it does not define how to verify that the backup is complete or how to restore it safely.

Attack Path

1. A gateway timeout or scheduler error occurs or is reported.
2. The Agent follows the documented ERR-002 or ERR-008 recovery procedure.
3. The Agent deletes the shared jobs.json scheduler state file.
4. The Agent platform is restarted.
5. Unrelated scheduled jobs disappear or must be reconstructed manually from incomplete external records.

Impact Assessment

The affected scope includes every job stored in the referenced local scheduler state file, not only the task that produced the error. The procedure can cause loss of reminders, recurring reports, monitoring jobs, and message-delivery tasks, as well as tem ...[truncated 204 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user or administrator confirmation before deleting shared scheduler state or restarting the platform.
• Verify corruption through parsing, schema validation, logs, and checksums rather than inferring it from a timeout.
• Prefer official scheduler repair, export, import, and targeted job-removal commands.
• Resolve and validate the canonical file path before any file operation.
• Create an atomic, timestamped backup and verify that it is readable before modifying the original.
• Restore from backup automatically if restart or state reconstruction fails.
• Separate individual jobs into recoverable records where supported, avoiding deletion of unrelated scheduler state.
• Restrict platform restart and shared-state deletion to an administrator-controlled troubleshooting workflow.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger rules are overly broad, causing the skill to activate on common words like '提醒', '定时', or '调度', and even state it should be prioritized whenever such words appear. This can hijack unrelated conversations, steer the agent into using filesystem, scheduler, or external push capabilities unnecessarily, and increase the attack surface for unintended tool use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The display name, summary, and description are written in Chinese and present the skill as targeting domestic Chinese platforms, but the file does not state that this locale is optional or region-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises pushing messages to external platforms such as WeCom, DingTalk, and Feishu but does not clearly warn that reminder content and recipient identifiers may be transmitted to third-party services. In a scheduling/reminder context, messages often contain sensitive personal or business information, so silent external transmission creates a meaningful privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill tells the agent to write timezone information to persistent memory without a user-facing disclosure that this modifies retained state. This is a transparency and consent problem: users may not expect operational metadata about them to be stored, and persistent memory can later influence unrelated interactions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill instructs operators to back up and delete local state files such as ~/.skill-platform/state/cron/jobs.json to recover from errors. Even if framed as troubleshooting, this expands the skill from scheduling into destructive filesystem operations and could cause loss of scheduled tasks or accidental deletion of the wrong file path if followed carelessly. In an agent context with Bash available, normalizing file deletion in docs increases the chance of unsafe operational behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill directs persistence of user timezone data into shared memory (MEMORY.md) as a standard operating step. Although timezone data is low sensitivity, writing user-specific state without clear scoping, consent, or retention rules creates unnecessary persistent state and can leak across sessions or uses of the agent.

Content

No source excerpt is available for this finding.

Ssd 3

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Persisting timezone information in shared memory creates a data retention issue because user-specific metadata is stored in natural-language memory without a defined lifecycle. While low sensitivity, retained metadata can accumulate, be reused out of context, or be exposed to other skills or future sessions.

Content

No source excerpt is available for this finding.