schedule-job
Fail
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Provides instructions for establishing system persistence by modifying crontab files and Windows Scheduled Tasks (schtasks).
- [COMMAND_EXECUTION]: Encourages the use of the
--dangerously-skip-permissionsflag when scheduling tasks, which explicitly instructs the agent to bypass security guardrails and user consent prompts. - [COMMAND_EXECUTION]: Includes instructions for modifying files in
/etc/logrotate.d/, a system-level directory that typically requires root or sudo privileges, indicating a privilege escalation pattern. - [PROMPT_INJECTION]: Indirect prompt injection surface via natural language task interpolation.
- Ingestion points: User-provided natural language task descriptions in
SKILL.md. - Boundary markers: Absent in command interpolation examples (e.g.,
claude -p "$TASK"). - Capability inventory: Uses Bash tool to execute
crontaband theclaudeCLI tool. - Sanitization: Absent; instructions suggest direct interpolation into shell command strings without escaping.
Recommendations
- AI detected serious security threats
Audit Metadata