The Agent Skills Directory

[SAFE]: The skill is a legitimate developer tool designed to catch common errors in cron scheduling. It provides educational content and a local validation engine.
[REMOTE_CODE_EXECUTION]: No remote code execution patterns were detected. The skill includes local Node.js scripts (scripts/cli.js and scripts/cron-engine.js) that perform string parsing and date calculations without using dangerous functions like eval() or exec().
[DATA_EXFILTRATION]: No data exfiltration risks were identified. The included scripts do not utilize network modules or file system APIs to access or transmit sensitive information.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data in the form of cron expressions, which represents a potential injection surface.
Ingestion points: User-supplied cron strings are passed as arguments to scripts/cli.js for analysis.
Boundary markers: The validation engine enforces a strict 5-field syntax and validates inputs against specific numeric ranges and allowed keywords.
Capability inventory: The scripts are restricted to mathematical parsing, logical checks for "death-traps," and date math. There are no capabilities for file writing, network communication, or system command execution.
Sanitization: Input is sanitized by splitting on whitespace and validating each token against specific regex patterns and range constraints.

cron-doctor