Cron Job Token Auditor

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:13 AM UTC
• Version: 1.0.0

Overview

This is a read-only cron audit skill with clear boundaries; the main caution is an optional unpinned ClawHub install command.

Installers that use `@latest` can change over time, so pin or verify the ClawHub CLI version if you need strict reproducibility. When using the skill, review any cron job prompts carefully because they may contain private operational details, but the skill instructs the agent to redact sensitive values and avoid making changes automatically.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:24

Finding

Unpinned npm Package Is Downloaded and Executed via npx

Content

View full analysis

Vulnerability Details

File Location: README.md, line 24
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

npx clawhub@latest install cron-job-auditor

Technical Analysis

The documented installation command instructs users to execute the mutable latest release of the third-party clawhub npm package. The npx utility can download a package that is not already installed and immediately execute its command-line code.

Because the latest distribution tag can be changed after this Skill has been reviewed, the effective code executed by users is not fixed to an audited version. The project supplies no exact version pin, integrity hash, lockfile, package provenance check, or inspection step for this command.

This does not demonstrate that the current clawhub package is malicious. The security issue is that compromise of the package, its publisher account, or the relevant package-distribution channel could cause a future invocation of the documented command to execute attacker-controlled code.

Attack Path

1. An attacker compromises the npm publisher account, package, or release process associated with clawhub.
2. The attacker publishes a malicious release and assigns it to the mutable latest distribution tag.
3. A user follows the installation command in README.md.
4. npx resolves and downloads the attacker-controlled release.
5. The downloaded package's command-line entry point executes with the permissions of the user who invoked npx.
6. The malicious process can access resources available to that user, subject to operating-system permissions and sandboxing.

Impact Assessment

Successful exploitation could result in arbitrary code execution under the invoking user's account. Depending on that account's permissions and environment, accessible assets could include project files, user-readable configuration, OpenClaw workspace data, environment variables, authenticati ...[truncated 731 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable @latest tag with an exact, reviewed package version, for example:

   bash

   npx clawhub@<reviewed-exact-version> install cron-job-auditor
   

2. Document how users can verify the expected package publisher, package provenance, and version before execution.

3. Where supported by the installation workflow, verify the downloaded artifact against a published cryptographic digest or trusted signature.

4. Prefer installing or downloading the pinned package without immediate execution, inspecting its metadata and contents, and only then invoking its CLI.

5. Keep the pinned version current through an explicit review process rather than automatically tracking latest.

6. Warn users not to invoke package-management commands with administrator privileges unless elevation is demonstrably necessary.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The README instructs users to run npx clawhub@latest install cron-job-auditor, which fetches and executes the latest published package version at install time rather than a pinned, reviewed release. This creates a supply-chain risk: if the package or a dependency is compromised, users may execute attacker-controlled code simply by following the documentation.

Content

No source excerpt is available for this finding.