Cron Helper

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:15 PM UTC
• Version: 1.0.0

Overview

This is a disclosed local cron-expression helper; it has accuracy and packaging weaknesses, but I found no hidden data access, persistence, exfiltration, or deceptive behavior.

Install only if you want a Chinese-language cron helper and treat its displayed next-run times as approximate. Do not rely on it for production scheduling decisions without checking results with a real cron parser, pin any optional pip dependencies before installing them, and only save generated files to safe workspace paths.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: README.md:93
• Finding: Unpinned Third-Party Package Installation Guidance## Vulnerability Details **File Location**: `README.md:93-97`, `references/quick_start.md:69-72`, `scripts/show_cron.py:208-224` **Vulnerability Type**: Unpinned dependency installation **Risk Level**: Medium ### Vulnerable Code Snippets `README.md:93-97`: ```bash pip install croniter python-dateutil ``` `references/quick_start.md:69-72`: ```bash pip install croniter ``` The application also repeatedly recommends the following command in `scripts/show_cron.py:208-224`: ```text pip install croniter ``` Although `scripts/requirements.txt:1-3` mentions specific package versions, the dependencies are commented out and are not used by the documented installation commands: ```text # croniter==1.3.8 # python-dateutil==2.8.2 ``` ### Technical Analysis The documentation instructs users to install mutable, unpinned package versions directly from the default Python Package Index. This prevents users from reproducing a reviewed dependency set and allows later package releases to become part of the effective execution environment without another review of the Skill. Installation of a Python package can execute package build or installation logic. Once installed, imported dependencies execute with the privileges of the Python process. No evidence was found that the currently named packages are malicious; the weakness is that the installation guidance does not constrain which release or artifact will be installed. ### Attack Path 1. A user follows the Skill's recommendation to run `pip install croniter` or `pip install croniter python-dateutil`. 2. Pip resolves the latest release available from its configured package index rather than a version reviewed with this project. 3. A compromised future release, compromised package index, or unsafe alternate index supplies a malicious distribution. 4. Installation or subsequent import executes attacker-controlled Python code. 5. The code runs with the privileges ...[truncated 745 chars]
• Remediation: ## Remediation Suggestions 1. Maintain reviewed dependencies in an active requirements file rather than commented examples. 2. Pin exact versions and verify compatibility before publication. 3. Generate and enforce cryptographic hashes for every distribution: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Prefer installation inside a dedicated virtual environment without administrative privileges. 5. Document the expected package index explicitly and warn against untrusted mirrors or extra indexes. 6. Add an automated dependency review process for updates instead of implicitly accepting the latest release. 7. Keep documentation and runtime messages consistent with the secured installation method.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/show_cron.py:16
• Finding: Cron Validation Accepts Out-of-Range Values and Invalid Steps## Vulnerability Details **File Location**: `scripts/show_cron.py:16-65`, `scripts/explain_cron.py:190-203` **Vulnerability Type**: Insufficient input validation **Risk Level**: Medium ### Vulnerable Code Snippets `scripts/show_cron.py:16-65`: ```python @staticmethod def validate_cron_expression(cron_expr: str) -> bool: parts = cron_expr.strip().split() if len(parts) != 5: return False for part in parts: if not CronParser._validate_part(part): return False return True @staticmethod def _validate_part(part: str) -> bool: if part == "*": return True valid_chars = set("0123456789*,-/") if not all(c in valid_chars for c in part): return False patterns = part.split(',') for pattern in patterns: if '/' in pattern: range_part, step_part = pattern.split('/', 1) if not step_part.isdigit(): return False if range_part != '*' and not CronParser._validate_range(range_part): return False elif '-' in pattern: if not CronParser._validate_range(pattern): return False elif pattern != '*' and not pattern.isdigit(): return False return True @staticmethod def _validate_range(range_str: str) -> bool: if '-' not in range_str: return False start, end = range_str.split('-', 1) return start.isdigit() and end.isdigit() and int(start) <= int(end) ``` `scripts/explain_cron.py:190-203`: ```python def validate_cron_expression(cron_expr: str) -> bool: parts = cron_expr.strip().split() if len(parts) != 5: return False valid_chars = set("0123456789*,-/") for part in parts: if not all(c in valid_chars for c in part): return False return True ``` ### Technical Analysis Both validators ch ...[truncated 1837 chars]
• Remediation: ## Remediation Suggestions 1. Parse each field with awareness of its allowed range rather than using one generic character validator. 2. Reject step values less than one. 3. Reject empty list entries, repeated separators, incomplete ranges, and multiple step separators. 4. Validate both endpoints of every range against the relevant field bounds. 5. Define explicitly whether names, `?`, `L`, and day-of-week value `7` are supported; documentation must match implementation. 6. Prefer a mature, reviewed cron parser for validation. 7. Add negative tests for values such as: ```text 60 * * * * * 24 * * * * * 0 * * * * * 13 * * * * * 8 */0 * * * * 1,,2 * * * * ``` 8. Ensure validation and explanation use the same parser so they cannot disagree.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/show_cron.py:68
• Finding: Execution-Time Function Returns Fabricated Results for Most Cron Expressions## Vulnerability Details **File Location**: `scripts/show_cron.py:68-99` **Vulnerability Type**: Unsafe and misleading scheduling logic **Risk Level**: Medium ### Vulnerable Code Snippet The following executable excerpt is from `scripts/show_cron.py:76-99`; comments have been omitted: ```python times = [] now = datetime.now() if cron_expr == "* * * * *": for i in range(count): times.append(now + timedelta(minutes=i)) elif cron_expr == "0 * * * *": for i in range(count): next_hour = now.replace(minute=0, second=0, microsecond=0) + timedelta(hours=i) if next_hour > now: times.append(next_hour) elif cron_expr == "0 0 * * *": for i in range(count): next_day = now.replace(hour=0, minute=0, second=0, microsecond=0) + timedelta(days=i) if next_day > now: times.append(next_day) else: for i in range(count): times.append(now + timedelta(hours=i)) return times[:count] ``` ### Technical Analysis Only three exact cron strings receive specialized treatment. Every other expression falls through to a generic hourly sequence that ignores the minute, hour, day, month, and weekday fields. For example, the documented weekday expression `0 9 * * 1-5` is not calculated as 09:00 on weekdays. It is displayed as a sequence based on the current time plus whole hours. The output is nevertheless labeled as upcoming execution times, which can cause users to treat estimates unrelated to the supplied schedule as authoritative results. Even the hard-coded branches have boundary issues. For `* * * * *`, the first returned value is the current `datetime`, including its current seconds and microseconds, rather than the next minute boundary. The hourly and daily branches can also return fewer than the requested number of results because candidates not later than `now` are skipped without generating replacements. ### Attack Path 1. A user ...[truncated 1125 chars]
• Remediation: ## Remediation Suggestions 1. Remove the generic hourly fallback. Unsupported expressions should produce an explicit error rather than invented timestamps. 2. Use a reviewed and securely pinned cron parser to calculate all supported expressions. 3. Normalize the base time and return only timestamps that strictly match the expression. 4. Define timezone behavior explicitly and accept a timezone parameter where appropriate. 5. Guarantee that the requested count is either returned or that the application clearly reports why fewer results are available. 6. Add tests comparing calculated results against known schedules, including ranges, lists, steps, weekdays, month boundaries, leap years, and daylight-saving transitions. 7. Rename output if approximate behavior is retained and prominently warn that it must not be used for operational scheduling decisions.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: If the skill is presented as an end-user cron utility but actually invokes external commands/subprocesses and contains automation-oriented behavior not disclosed in the description, that is a transparency and safety problem. Hidden process execution expands the attack surface and can surprise an agent runtime or user who expects a passive validation utility rather than command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: If the skill is presented as an end-user cron utility but actually invokes external commands/subprocesses and contains automation-oriented behavior not disclosed in the description, that is a transparency and safety problem. Hidden process execution expands the attack surface and can surprise an agent runtime or user who expects a passive validation utility rather than command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: If the skill is presented as an end-user cron utility but actually invokes external commands/subprocesses and contains automation-oriented behavior not disclosed in the description, that is a transparency and safety problem. Hidden process execution expands the attack surface and can surprise an agent runtime or user who expects a passive validation utility rather than command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: If the skill is presented as an end-user cron utility but actually invokes external commands/subprocesses and contains automation-oriented behavior not disclosed in the description, that is a transparency and safety problem. Hidden process execution expands the attack surface and can surprise an agent runtime or user who expects a passive validation utility rather than command execution.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def run_command(cmd):
    """运行命令并返回输出"""
    try:
        result = subprocess.run(
            cmd, 
            shell=True, 
            capture_output=True,

• Confidence: 97% confidence
• Finding: Using shell=True is a classic parameter-abuse risk because the shell treats metacharacters, expansions, and chaining operators as executable syntax. In a skill context, this is more dangerous because helper scripts may later be wired to agent-controlled or user-influenced inputs; if that happens, an attacker could run arbitrary OS commands under the agent's privileges.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def run_command(cmd):
    """运行命令并返回输出"""
    try:
        result = subprocess.run(
            cmd, 
            shell=True, 
            capture_output=True,

• Confidence: 96% confidence
• Finding: Using `subprocess.run(..., shell=True)` is a classic tool-parameter abuse pattern because the shell will parse metacharacters, command substitution, and chaining operators. In the context of a cron-helper skill, cron expressions and related strings are naturally text inputs; if this helper or pattern is reused with externally influenced input, an attacker could execute arbitrary commands on the host.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The README states that the skill will explain cron expressions '用中文' (in Chinese), which imposes a specific language choice. Under the policy, forcing a language without offering the user a choice or documenting a justified locale constraint is a violation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation explicitly instructs users to run shell commands (`python ...`, `exec python ...`) and static analysis indicates shell and file-write capabilities, yet the manifest declares no `permissions` or `allowed-tools` scope. This creates a capability/scope mismatch that can lead to over-broad execution in agent environments, making it harder to enforce least privilege and easier for a modified or substituted script to perform unintended actions.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The manifest description and the full markdown content require Chinese comprehension, which effectively forces a specific language for using the skill. The file does not mention any user choice, localization option, or justification for a Chinese-only constraint.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: 该快速开始文档从标题到操作说明均仅使用中文，且没有说明这是面向特定中文用户群的区域性技能，也未提供语言选择或英文替代。根据规则，强制特定语言而没有用户选择或明确正当化，属于自然语言层面的语言/locale policy 违规。

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill manifest describes cron creation/validation/display functionality, but the code also offers arbitrary file-writing capability. This capability expansion is dangerous in agent environments because users or downstream prompts may trigger side effects not implied by the declared purpose, increasing the risk of unintended persistence or file tampering.

Tainted flow: 'filename' from input (line 131, user input) → open (file write)

Medium

• Category: Data Flow

Content

if not filename:
            filename = "cron_expression.txt"
        
        with open(filename, 'w', encoding='utf-8') as f:
            f.write(f"# 生成的cron表达式\n")
            f.write(f"# 生成时间: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n")
            f.write(f"{cron_expr}\n")

• Confidence: 94% confidence
• Finding: The script writes to a filesystem path taken directly from interactive user input without any restriction or validation. In an agent or shared execution context, this enables arbitrary file overwrite/creation within the process's permissions, which exceeds the expected cron-helper behavior and can be abused to clobber configuration, drop misleading files, or tamper with workspace content.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This code file contains all user-facing descriptions, prompts, and help text in Chinese, including the module docstring, CLI argument help, input prompt, and output messages. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable locale/language constraint when no choice or justification is provided.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: 技能描述称支持标准 5 字段和扩展格式，但该实现在 L75-L76 强制要求必须正好 5 个字段，排除了常见扩展格式（如 6/7 字段）。同时代码仅支持数字、'*'、','、'-'、'/' 的简单组合，没有实现扩展 cron 常见特性。

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: L276 的提示明确写明 '?' 可用于日和星期字段，表示无特定值；但 L199-L202 的验证字符集不包含 '?'，会将这类表达式判定为无效，且解析逻辑也没有对应处理。这属于文档/用户提示与实际代码行为直接矛盾，容易误导用户认为该脚本支持扩展 cron 语法。

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module documentation claims the script validates cron expressions and shows recent execution times, but the implementation knowingly uses approximations that often do not match the expression. This creates a trust mismatch: users may rely on the output for operational scheduling decisions and silently introduce misconfigured jobs.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code's natural-language interface is entirely in Chinese, including the module docstring, command help, prompts, validation messages, and usage guidance. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable locale-policy issue unless the constraint is explicitly justified, which is not present here.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The function presents itself as computing upcoming execution times for arbitrary cron expressions, but it only handles a few hard-coded cases and otherwise falls back to a generic hourly schedule. In a scheduling helper skill, this can mislead users into deploying incorrect automation windows, causing jobs to run too often, too rarely, or at the wrong times.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The manifest describes a tool for creating, validating, and displaying cron expressions and execution times. In this file, the skill includes a generic shell-command execution helper using subprocess.run(..., shell=True), which is an execution capability unrelated to cron parsing or schedule calculation itself.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_command(cmd):
    """运行命令并返回输出"""
    try:
        result = subprocess.run(
            cmd, 
            shell=True, 
            capture_output=True,

• Confidence: 95% confidence
• Finding: The script invokes subprocess.run with shell=True, which causes the command string to be interpreted by a shell rather than executed as a fixed argument vector. Even though the current call sites use hard-coded commands, this pattern is dangerous because any future or indirect user-controlled input passed into run_command could become a command injection path, and test scripts in skills still expand the attack surface.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This Python file uses Chinese-only natural-language documentation and console output throughout, including the module docstring and test status messages. The skill does not offer any language selection or indicate that it is intentionally region-specific, which conflicts with the policy against forcing a specific language without user opt-in.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The manifest describes a tool for creating, validating, and displaying cron expressions, but this file implements command execution through subprocess.run with shell=True. Spawning shell commands is not a direct cron-expression-helper capability; even in a test script, it introduces an execution capability beyond the skill's stated purpose.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_command(cmd):
    """运行命令并返回输出"""
    try:
        result = subprocess.run(
            cmd, 
            shell=True, 
            capture_output=True,

• Confidence: 94% confidence
• Finding: The test helper executes shell commands with `shell=True`, which makes the command string subject to shell interpretation. While the current test cases are hardcoded, this helper is generic and would become command-injection-prone if any future caller passes user-controlled cron expressions or arguments into `cmd` without strict escaping.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This markdown file's headings, descriptions, and usage guidance are entirely in Chinese, which effectively forces a specific language on users. The policy allows locale constraints only when they are explicitly justified or when users are given a language/locale choice, neither of which appears here.

Intent-Code Divergence

Low

• Confidence: 76% confidence
• Finding: 该文件作为技能文档，明确讲解了 `?` 和 `L` 等并非所有5字段标准cron实现都支持的语法，还给出可用示例。若技能实际验证/创建逻辑未一致支持这些扩展，文档就会与真实行为发生意图层面的偏差；即使清单提到“扩展格式”，这里也没有说明支持边界，存在文档与实际实现不一致的风险。