Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only scheduler skill whose persistent tasks and optional external delivery are disclosed and aligned with its cron setup purpose.
Before installing, treat scheduled jobs as persistent automation: review each job prompt, delivery destination, and retention setting. Avoid sending sensitive summaries to chat channels or webhooks unless the destination is trusted and secured.
The description text forces a specific language/locale in the skill's natural-language interface and examples without any opt-in or alternative language option. Under the policy, language constraints should be optional or explicitly justified as region-specific.
The skill explicitly documents a webhook delivery mode that sends task output to an external HTTP endpoint, but provides no warning about data egress, authentication, transport security, or the sensitivity of scheduled task results. In a scheduler skill, jobs may process emails, calendars, health data, or other private content, so silently enabling outbound delivery increases the risk of unintended exfiltration or disclosure.
No suspicious patterns detected.
