scheduled-tasks

Fail

Audited by Socket on Mar 1, 2026

1 alert found:

Obfuscated File
Obfuscated FileHIGH
SKILL.md

Based on the metadata and examples, this component's intended function (manage cron jobs) necessarily allows scheduling of arbitrary shell commands provided via user input. That capability is high-risk: it enables persistence, arbitrary code execution at scheduled times, and potential data exfiltration or backdoors — especially if run with elevated privileges or if run.py does not enforce strict validation and restrictions. Because the implementation (run.py) is not provided, I cannot confirm whether safe-guards exist; treat the package as moderately high risk until code review shows explicit mitigations (strict input validation/quoting, restriction to unprivileged user crontab, audit logging, and access controls). Recommend not running with elevated privileges and requiring manual review of crontab changes before applying.

Confidence: 98%
Audit Metadata
Analyzed At
Mar 1, 2026, 12:37 AM
Package URL
pkg:socket/skills-sh/cklxx%2Felephant.ai%2Fscheduled-tasks%2F@98d2eaf20744c9839749d14300f67155f05284b7