ClawHub
Back to skill

Security audit

Cron

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local-only scheduling aid with disclosed file storage and no evidence of hidden network, credential, destructive, or background behavior.

Before installing, note that the skill can use local command execution for scheduling workflows and will store schedule data locally. Use it for intended recurring-task cases, and review or remove stored job files if you no longer want that history kept.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger keywords are generic terms such as 'schedule', 'local', and 'engine', which can cause the skill to activate in unrelated contexts. In an MD+EXEC skill, unintended activation matters because it may lead the agent to use local execution-capable workflows when the user did not intend to invoke this scheduling tool.

Static analysis

No suspicious patterns detected.