The Agent Skills Directory

[PERSISTENCE]: The core functionality of the skill is to register recurring tasks with host-level schedulers including crontab, OpenClaw, Railway, and system process managers. This allows arbitrary commands to persist and execute across reboots and outside the immediate control of the agent session.
[COMMAND_EXECUTION]: The skill provides specific shell command templates for the agent to execute, such as gbrain sync --all --parallel 4 --workers 4 --skip-failed and chained commands using semicolons like gbrain sources refresh <id>; gbrain sync .... This pattern of shell execution on the host environment is highly sensitive.
[PRIVILEGE_ESCALATION]: Interacting with system-level scheduling utilities (like crontab or systemd/process managers) often requires or leads to elevated permissions. If the agent manages crontabs for other users or system-wide schedules, it can lead to privilege escalation.
[INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where job names, schedules, and skills-to-run are ingested as parameters. If these inputs originate from untrusted external sources (e.g., a user prompt or retrieved data), an attacker could inject shell metacharacters or malicious commands into the scheduler registration process.
Ingestion points: Job definition parameters including 'Name', 'Schedule (cron expression)', and 'Skill to run' are defined in Phase 1.
Boundary markers: No specific delimiters or safety instructions are provided to prevent the agent from obeying instructions embedded within these job definitions.
Capability inventory: The skill utilizes put_page to write reports and explicitly instructs the agent to modify host scheduler configurations and execute CLI tools.
Sanitization: There is no evidence of sanitization, validation, or escaping logic for the job names or IDs before they are interpolated into shell commands or file paths.

cron-scheduler