cron
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The 'Task' mode allows the agent to schedule and later execute instructions provided in the
messageparameter. This creates a surface where malicious instructions could be injected into the scheduling queue and executed without active user context. - Ingestion points: The
messageparameter in thecrontool (defined inSKILL.md). - Boundary markers: The skill does not define delimiters or specific instructions to prevent the agent from obeying prompts embedded within the scheduled message.
- Capability inventory: The agent is instructed to execute the message as a task description, leveraging the agent's full suite of available tools and capabilities.
- Sanitization: No sanitization or validation of the scheduled task content is mentioned in the skill definition.
- [DYNAMIC_EXECUTION]: The skill documentation specifies a 'Task' mode where a string provided by a user or external source is treated as a task description that the agent 'executes'. This represents dynamic generation and execution of instructions at runtime.
Audit Metadata