Security audit

Schedule Manager Free

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local scheduling helper that stores task definitions and history in plaintext files, with no evidence of hidden network upload, system scheduler modification, or destructive behavior.

Install only if you are comfortable with the agent keeping schedule data in local plaintext files under ~/workspace/schedule. Avoid putting secrets or highly sensitive personal details into task text, review jobs.json periodically, and require explicit confirmation before scheduled tasks use other skills such as mail or file backup.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

Medium

Confidence: 78% confidence
Finding: The skill claims it will not modify crontab or launchd, but it exposes the exec tool and does not tightly constrain command usage to safe file operations. In an agent setting, ambiguous exec guidance can enable implementation drift where the agent uses shell commands beyond intended local JSON persistence, potentially changing host scheduling state or running unsafe commands.

Intent-Code Divergence

Low

Confidence: 78% confidence
Finding: The skill claims it will not modify crontab or launchd, but it exposes the exec tool and does not tightly constrain command usage to safe file operations. In an agent setting, ambiguous exec guidance can enable implementation drift where the agent uses shell commands beyond intended local JSON persistence, potentially changing host scheduling state or running unsafe commands.

Vague Triggers

Medium

Confidence: 74% confidence
Finding: The activation scope is broad and loosely defined, making it easier for an agent to invoke the skill in contexts the user did not clearly intend. For a scheduling skill that persists tasks and may later trigger other capabilities, over-broad triggering raises the chance of silent creation, modification, or execution of reminders and delegated actions.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill persists jobs, preferences, and execution history locally, but it does not prominently warn that this data may contain sensitive behavioral information such as routines, work habits, time zones, and task contents. If other local users, tools, or repos can access the workspace, this creates a privacy and data exposure risk.

Static analysis

No suspicious patterns detected.