Security audit

Cron Health Monitor

Security checks for vulnerabilities and agentic risk

Overview

This cron monitoring skill is mostly coherent, but it can direct agents to automatically change, run, create, and disable cron jobs without clear user approval boundaries.

Install only if you intend to let an agent help repair cron jobs, not merely monitor them. Before use, require explicit approval for any cron update, run, creation, disable action, shell command, or file write; restrict repairs to known job IDs and approved directories; and review generated repair cron payloads before they execute.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The playbook expands from passive cron health monitoring into operational actions that modify the filesystem and invoke shell-based directory creation. Even if framed as repair guidance, telling an agent to use exec for mkdir and then write files creates unnecessary capability extension and can be abused to alter arbitrary paths, especially if job payloads or paths are not tightly constrained.

Context-Inappropriate Capability

Low

Confidence: 78% confidence
Finding: Directing the skill to write departmental repair logs is outside the narrow purpose of monitoring cron health and introduces an additional write surface. While lower risk than shell execution, it still enables persistence or tampering in organizational notes without any demonstrated need or approval boundary.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger phrase 'fix cron' is broad enough to match ordinary troubleshooting requests, which can cause the skill to activate in situations where the user did not explicitly intend automated monitoring or repair delegation. In this skill's context, that matters because the documented behavior includes repair task delegation and creation of one-time repair cron jobs, increasing the chance of unintended system-modifying workflows.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly promotes automatic repair delegation and creation of one-time repair cron jobs, but the description does not present a clear warning that these actions may modify system state. This is dangerous because users may invoke what appears to be a monitoring skill without realizing it can trigger autonomous changes, creating risks of unintended cron edits, persistence changes, or operational disruption.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The playbook instructs direct cron job modification through update actions without any warning, confirmation, or authorization check, despite these being state-changing operations. In a repair context this can silently alter production job behavior, creating integrity risk and making accidental or malicious misconfiguration easier.

Ssd 1

Medium

Confidence: 95% confidence
Finding: This guidance explicitly tells the operator to rewrite the job prompt so results are routed through sessions_send and to avoid the normal message tool. That is a strong indicator of channel-switching designed to bypass expected communication, monitoring, or policy controls, which materially increases the chance of covert data flow or evasion of guardrails.

Ssd 1

Medium

Confidence: 92% confidence
Finding: The instruction to insert natural-language text such as 'Do NOT reply HEARTBEAT_OK' is an execution override that attempts to suppress expected behavior and force alternate agent actions. Prompt-level behavioral overrides are risky because they can disable safety or monitoring conventions and make downstream cron behavior less predictable and more difficult to audit.

Static analysis

No suspicious patterns detected.