daily-rhythm

clawhub:daily-rhythm

View source

100/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

Score

100/100

LOW 2

Findings (2)

LOW

pip install arbitrary package EXTDL_009

external-download L48

Detects pip install of arbitrary packages that modify the host environment

pip install go

FIX

Pin all pip packages to exact versions (e.g., pip install package==1.2.3). Use a requirements.txt or pyproject.toml with pinned versions and hash verification.

FP?

Likely FP if the match is in documentation showing how to install the skill's own PyPI package.

LOW

Cron or scheduled command execution CMDEXEC_011

command-execution L83

Detects cron jobs or scheduled tasks that execute commands

crontab -e

FIX

Validate cron expressions and scheduled commands against an allowlist. Ensure scheduled tasks cannot be modified by untrusted input and log all cron job changes.

FP?

Likely FP if the match is a documentation reference to crontab syntax or a short mention of cron in a description of scheduling concepts.