Cron Mastery 1.0.3

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:53 AM UTC
• Version: 1.0.0

Overview

The skill is a scheduling guide, but its examples can route reminders and email summaries to a fixed Telegram recipient and include risky cleanup instructions.

Review before installing. Do not copy the Telegram examples as-is; replace the recipient with a verified user-controlled destination or disable external delivery. Be cautious with workflows that read email or send summaries externally, and avoid deleting the cron jobs state file unless you have backed it up and accept losing scheduled jobs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:61

Finding

Hardcoded Telegram Recipient Can Cause Unauthorized Disclosure

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:61
• references/templates.md:26
• references/templates.md:78

Vulnerability Type: Hardcoded external notification recipient
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:59-62:

json

"delivery": {
  "mode": "announce",
  "channel": "telegram",
  "to": "1027899060"
}

references/templates.md:23-27:

json

"delivery": {
  "mode": "announce",
  "channel": "telegram",
  "to": "1027899060"
},

references/templates.md:75-79:

json

"delivery": {
  "mode": "announce",
  "channel": "telegram",
  "to": "1027899060"
}

Technical Analysis

The Skill provides reusable cron-job templates containing the fixed Telegram recipient ID 1027899060. These examples are presented as patterns for delivering reminders and recurring summaries to the current user, but the recipient is not derived from trusted session configuration or verified against the requesting user's account.

An agent following these templates literally may schedule an announce delivery to the hardcoded account. The complex recurring-task example can process private information, such as unread email summaries, before delivering the result. Consequently, the fixed destination creates a direct data-routing flaw rather than merely a cosmetic example-value issue.

No evidence establishes who controls the hardcoded account. Nevertheless, its use as a default external destination can result in unauthorized disclosure whenever that account does not belong to the requesting user.

Attack Path

1. A user requests a scheduled reminder or recurring summary.
2. The agent loads this Skill and selects one of its supplied cron templates.
3. The agent copies the template without replacing the hardcoded delivery.to value.
4. A cron job is registered with Telegram account 1027899060 as its destination.
5. At execution time, the job g ...[truncated 1004 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace every concrete recipient ID with an unambiguous placeholder, for example:

   json

   "to": "<VERIFIED_USER_TELEGRAM_ID>"
   

2. Require the destination to be obtained from trusted runtime or session configuration rather than Skill documentation, user-generated content, or persistent examples.

3. Verify that the selected destination belongs to the user who requested the scheduled task before registering the cron job.

4. Display the resolved channel and recipient to the user and request confirmation before scheduling jobs that transmit private information.

5. Fail closed when no verified recipient is available. Do not silently retain the example recipient or create an externally delivered job.

6. For workflows that summarize email or other sensitive sources, apply data-minimization controls and require explicit authorization for external delivery.

7. Add validation that rejects known example values and prevents cron-job creation when unresolved placeholders or fixed demonstration IDs remain in the payload.

8. Review existing scheduled jobs for recipient 1027899060; disable affected jobs and recreate them only after validating the intended recipient.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The troubleshooting guidance tells operators to manually delete ~/.openclaw/state/cron/jobs.json, which is a destructive filesystem action outside the core purpose of a scheduling skill and is presented without strong safeguards. If followed blindly, it can erase scheduler state, lose pending jobs/reminders, and normalize unsafe manual intervention in application state files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill recommends deleting a gateway state file as a fix for timeout/corruption, but it does not warn that this may destroy scheduled jobs, reminders, or other recoverable state. In a cron/reminder skill, that omission is especially risky because the deleted file likely contains the very scheduling data users rely on.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The template hard-codes Telegram delivery to a specific recipient ID, enabling external message transmission to a fixed destination unrelated to the current user. In a skill about timing and reminders, this is dangerous because copied examples may silently route notifications or sensitive content to the wrong party, creating privacy leakage and misdelivery risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The example sends an announced notification to Telegram without warning that the content leaves the local/session context and is delivered to an external messaging service. Users or downstream authors may treat it as an internal reminder template, causing unintended disclosure or surprise delivery to a third-party platform.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This template expands a scheduling skill into data-access and content-retrieval actions by instructing the agent to search unread emails and external news, which goes beyond mere cron configuration. In the context of a reusable template, that creates a risky precedent for unnecessary privilege use and could expose sensitive user data if adopted without explicit consent and scope limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This recurring example combines access to unread emails and external news retrieval with Telegram delivery, but does not disclose the privacy and data-flow implications. Because the skill is framed as a timing aid, the omission makes the capability more dangerous: users may not expect private inbox contents to be processed and then transmitted through an external channel.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The recurring task example fixes the schedule timezone to Africa/Cairo, which imposes a locale setting in natural-language-facing behavior. There is no indication that this is optional, user-selected, or justified as region-specific, so it conflicts with the policy against forcing a specific locale without opt-in.

Content

No source excerpt is available for this finding.