---
name: agent-cron-governance-auditor
description: OpenClaw skill for governed agent workflows.
---
Agent Cron Governance Auditor
**Version:** 1.0.0
**Category:** governance
**Status:** PENDING_VIPER_GATE
What It Does
Agent Cron Governance Auditor reviews scheduled agent automation entries (crontab files or OpenClaw-style JSON cron configs) for governance gaps before new jobs are enabled or released. It flags:
→ Missing owner / accountability fields
→ Missing stop conditions or budget caps
→ High-risk command patterns (destructive operations, pipe-to-shell)
→ Disabled jobs that may silently block pipeline stages
→ Uncontrolled schedules (every-minute wildcards)
→ Missing heartbeat / evidence trail references
**Safety-first:** The skill performs static read-only analysis only. It does not enable, disable, or modify any cron jobs, config files, or secrets.
Who It's For
→ **Pipeline operators** who need a pre-enable governance check before activating new scheduled automations
→ **Security reviewers** auditing OpenClaw or agent platform cron estates for ownership and risk gaps
→ **Compliance teams** that need evidence of governance controls (owner, stop condition, approval gate) on all scheduled automations
→ **DevOps / SRE teams** maintaining multi-agent cron estates who need structured governance evidence for audit trails
Requirements
→ Python 3.8+ (stdlib only — no pip installs)
→ Read access to the cron config file being audited (crontab format or JSON)
Usage
```bash
Audit a JSON cron config
python3 scripts/audit_cron_governance.py --target cron-config.json
Audit a crontab file
python3 scripts/audit_cron_governance.py --target /etc/cron.d/sparta-jobs
Run built-in self-test
python3 scripts/audit_cron_governance.py --self-test
JSON output (default)
python3 scripts/audit_cron_governance.py --target cron-config.json --json
```
Output Schema
```json
{
"ok": true,
"status": "PASS | REVIEW | BLOCKED | ERROR",
"parse_mode": "json | crontab",
"jobs_audited": 5,
"total_risk_score": 0,
"high_findings": 0,
"medium_findings": 2,
"job_details": [...],
"findings": [...],
"recommendations": [...],
"mutated_files": []
}
```
Status Values
| Status | Meaning |
|--------|---------|
| `PASS` | No governance gaps found — safe to proceed |
| `REVIEW` | Medium/info findings only — review before enabling |
| `BLOCKED` | High-severity findings — resolve before enabling any new cron jobs |
| `ERROR` | Target file not found or unreadable |
QA Fixture Reference
### Self-test (built-in)
Run `--self-test` — produces deterministic:
→ `clean_fixture` → `PASS` (complete governance fields, safe command)
→ `risky_fixture` → `BLOCKED` (missing fields, high-risk command, wildcard schedule)
### Scenario 1: Clean JSON cron config
```bash
python3 scripts/audit_cron_governance.py --target examples/clean-cron.json
Expected: status=PASS, total_risk_score=0, high_findings=0
```
### Scenario 2: Risky crontab with high-risk commands
```bash
python3 scripts/audit_cron_governance.py --target examples/risky-cron.json
Expected: status=BLOCKED, high_findings >= 1
```
### Scenario 3: Missing target file
```bash
python3 scripts/audit_cron_governance.py --target /nonexistent/path.json
Expected: ok=False, status=ERROR, clean JSON error output
```
Security Boundary
→ Read-only file access only — no cron mutation, no config writes
→ No subprocess / shell execution
→ No network calls
→ No environment variable reads (no `.env` access)
→ Pattern definitions are string literals only — never executed
→ `mutated_files` is always `[]`
Release evidence
Reviewed in the 2026-06-15 GetAgentIQ warehouse propagation cycle.