@wonsukchoi/crondex 0.1.1 → 0.3.0

package/jobs/content/social-mentions-watch.yaml

@@ -0,0 +1,32 @@
+id: social-mentions-watch
+version: 1
+name: Social Mentions Watch
+description: >
+  Scans for recent mentions of your brand, product, or repo and summarizes
+  them. Use this if you want to catch a complaint or bug report on social
+  media before it turns into a bigger problem.
+category: content
+tags: [social, mentions, monitoring]
+schedule: "0 9 * * *"
+timezone: "UTC"
+runner: agent-prompt
+prompt: |
+  Search for mentions of "{{brand_or_repo}}" from the last {{lookback_hours}}
+  hours across whatever sources you have access to (X/Twitter, Reddit,
+  Hacker News, web search).
+  1. List each mention with source, link, and a one-line sentiment read
+     (positive/neutral/negative).
+  2. Flag anything that looks like a bug report, complaint, or something
+     needing a response.
+  3. If nothing found, just say so.
+variables:
+  brand_or_repo:
+    default: "your project"
+    description: Name, handle, or repo to search mentions of.
+  lookback_hours:
+    default: 24
+    description: Window of mentions to consider.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: >
+  No generic script mode — needs whatever search/API access your agent has
+  (web search, X API, Reddit API, etc.); sources vary too much to script generically.

package/jobs/devops/db-backup-verify.yaml

@@ -0,0 +1,37 @@
+id: db-backup-verify
+version: 1
+name: Database Backup Restore Verification
+description: >
+  Actually restores your latest database backup to a throwaway database
+  and checks it's queryable. Use this if `backup-reminder` isn't enough —
+  a backup file existing doesn't mean it's actually restorable.
+category: devops
+tags: [database, backup, postgres]
+schedule: "0 5 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  dump={{dump_path}}; scratch_db={{scratch_db_name}};
+  [ -f "$dump" ] || { echo "ERROR: $dump not found"; exit 1; };
+  command -v pg_restore >/dev/null 2>&1 || { echo "ERROR: pg_restore not installed"; exit 1; };
+  dropdb --if-exists "$scratch_db" 2>/dev/null;
+  createdb "$scratch_db" || { echo "ERROR: could not create scratch db $scratch_db"; exit 1; };
+  pg_restore -d "$scratch_db" "$dump" >/dev/null 2>&1;
+  count=$(psql -d "$scratch_db" -tAc "SELECT count(*) FROM {{checkpoint_table}}" 2>/dev/null);
+  dropdb --if-exists "$scratch_db" 2>/dev/null;
+  if [ -z "$count" ]; then echo "FAILED: restore or query failed on $dump"; exit 1;
+  else echo "OK: restored $dump, $checkpoint_table has $count rows"; fi
+variables:
+  dump_path:
+    default: "./backups/latest.dump"
+    description: Path to the pg_dump/pg_restore-format backup file.
+  scratch_db_name:
+    default: "backup_verify_scratch"
+    description: Throwaway database name used for the test restore (created and dropped each run).
+  checkpoint_table:
+    default: "users"
+    description: A table expected to have rows — used to confirm the restore actually worked.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Postgres-specific (pg_restore/psql/createdb/dropdb) — adapt the command
+  for other database engines. Needs CREATE/DROP DATABASE privileges.

package/jobs/devops/disk-space-check.yaml

@@ -0,0 +1,26 @@
+id: disk-space-check
+version: 1
+name: Disk Space Check
+description: >
+  Checks how full a disk/volume is and warns you before it fills up.
+  Use this if you've ever had a server or laptop grind to a halt because
+  disk usage crept up unnoticed.
+category: devops
+tags: [disk, monitoring, maintenance]
+schedule: "0 */6 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  path={{path}}; threshold={{threshold_pct}};
+  pct=$(df -P "$path" | awk 'NR==2 {gsub("%","",$5); print $5}');
+  if [ "$pct" -ge "$threshold" ]; then echo "WARNING: $path is ${pct}% full (threshold ${threshold}%)"; exit 1;
+  else echo "OK: $path is ${pct}% full"; fi
+variables:
+  path:
+    default: "/"
+    description: Mount point or path to check.
+  threshold_pct:
+    default: 85
+    description: Warn when usage reaches this percentage.
+compatible_agents: [generic, claude, codex]
+notes: Zero-token, deterministic. Uses `df -P` for portable output across macOS/Linux.

package/jobs/devops/docker-image-prune.yaml

@@ -0,0 +1,24 @@
+id: docker-image-prune
+version: 1
+name: Docker Image & Container Prune
+description: >
+  Cleans up stopped containers and dangling Docker images so they don't
+  quietly eat your disk. Use this if you run Docker locally or on a server
+  and never remember to clean up after yourself.
+category: devops
+tags: [docker, cleanup, disk-space]
+schedule: "0 4 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v docker >/dev/null 2>&1 || { echo "docker not installed, skipping"; exit 0; };
+  docker container prune -f --filter "until={{until}}";
+  docker image prune -f --filter "until={{until}}"
+variables:
+  until:
+    default: "24h"
+    description: Only remove containers/images older than this (Docker duration syntax, e.g. "24h", "720h").
+compatible_agents: [generic, claude, codex]
+notes: >
+  Destructive by nature (removes stopped containers and dangling images) —
+  the `until` default of 24h protects anything recent. Widen with care.

package/jobs/devops/env-drift-check.yaml

@@ -0,0 +1,34 @@
+id: env-drift-check
+version: 1
+name: Env File Drift Check
+description: >
+  Compares your .env against .env.example and flags keys that are missing
+  or extra. Use this if you've ever deployed and hit a crash because a new
+  required env var never got set.
+category: devops
+tags: [config, env, drift]
+schedule: "0 8 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  example={{example_path}}; actual={{env_path}};
+  [ -f "$example" ] || { echo "ERROR: $example not found"; exit 1; };
+  [ -f "$actual" ] || { echo "ERROR: $actual not found"; exit 1; };
+  ex_keys=$(grep -vE '^\s*#|^\s*$' "$example" | cut -d= -f1 | sort -u);
+  ac_keys=$(grep -vE '^\s*#|^\s*$' "$actual" | cut -d= -f1 | sort -u);
+  missing=$(comm -23 <(echo "$ex_keys") <(echo "$ac_keys"));
+  extra=$(comm -13 <(echo "$ex_keys") <(echo "$ac_keys"));
+  [ -n "$missing" ] && echo "MISSING (in $example, not in $actual): $missing";
+  [ -n "$extra" ] && echo "EXTRA (in $actual, not in $example): $extra";
+  [ -z "$missing" ] && [ -z "$extra" ] && echo "OK: env keys match example"; true
+variables:
+  example_path:
+    default: ".env.example"
+    description: Path to the example/template env file.
+  env_path:
+    default: ".env"
+    description: Path to the actual env file to check.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token, deterministic. Requires bash (uses process substitution) —
+  won't run under plain POSIX sh.

package/jobs/devops/license-compliance-check.yaml

@@ -0,0 +1,31 @@
+id: license-compliance-check
+version: 1
+name: Dependency License Compliance Check
+description: >
+  Scans your dependencies for licenses you've flagged as risky (like GPL
+  or AGPL). Use this if you've ever shipped something and only later
+  found out a dependency's license doesn't play well with your product.
+category: devops
+tags: [license, compliance, dependencies]
+schedule: "0 8 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  cd {{repo_path}} &&
+  if [ -f package.json ]; then
+    npx --yes license-checker --summary --excludePrivatePackages 2>/dev/null | grep -iE "{{flagged_licenses}}" && echo "^ flagged licenses found above" || echo "OK: no flagged licenses found";
+  else
+    echo "no package.json found — this job only supports npm/Node projects currently";
+  fi
+variables:
+  repo_path:
+    default: "."
+    description: Path to the repo to check.
+  flagged_licenses:
+    default: "GPL|AGPL"
+    description: Regex alternation of license names to flag.
+compatible_agents: [generic, claude, codex]
+notes: >
+  npm/Node projects only (uses `npx license-checker`, downloads on first
+  run). For other ecosystems, swap in the equivalent tool
+  (pip-licenses, cargo-license, etc.) and adjust the command.

package/jobs/devops/orphaned-branch-cleanup.yaml

@@ -0,0 +1,28 @@
+id: orphaned-branch-cleanup
+version: 1
+name: Orphaned Branch Cleanup
+description: >
+  Lists remote branches already merged into main that nobody's deleted
+  yet. Use this if your branch list has become a graveyard nobody wants
+  to clean up.
+category: devops
+tags: [git, cleanup, branches]
+schedule: "0 9 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  cd {{repo_path}} && git fetch --prune >/dev/null 2>&1;
+  merged=$(git branch -r --merged {{base_branch}} | grep -v -E "(\*|{{base_branch}}$)" | sed 's#origin/##');
+  if [ -z "$merged" ]; then echo "OK: no merged branches to clean up";
+  else echo "Merged into {{base_branch}}, safe to delete:"; echo "$merged"; fi
+variables:
+  repo_path:
+    default: "."
+    description: Path to the repo to check.
+  base_branch:
+    default: "main"
+    description: Branch to check merges against.
+compatible_agents: [generic, claude, codex]
+notes: >
+  List-only by design — never deletes anything. Review the list, then
+  `git push origin --delete <branch>` yourself for ones you actually want gone.

package/jobs/devops/stale-dependency-pr-nudge.yaml

@@ -0,0 +1,25 @@
+id: stale-dependency-pr-nudge
+version: 1
+name: Stale Dependency PR Nudge
+description: >
+  Lists open dependency-bump pull requests (from Dependabot/Renovate) that
+  have been sitting for a while. Use this if automated PRs pile up and
+  quietly go stale instead of getting merged or closed.
+category: devops
+tags: [github, dependencies, pr]
+schedule: "0 9 * * 1-5"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v gh >/dev/null 2>&1 || { echo "gh CLI not installed, skipping"; exit 0; };
+  cd {{repo_path}} && gh pr list --state open --json number,title,author,createdAt --jq \
+    '.[] | select(.author.login | test("dependabot|renovate"; "i")) | select((now - (.createdAt | fromdateiso8601)) > ({{stale_days}} * 86400)) | "#\(.number) \(.title) (opened \(.createdAt))"'
+variables:
+  repo_path:
+    default: "."
+    description: Path to the repo to check.
+  stale_days:
+    default: 3
+    description: Flag dependency PRs open longer than this many days.
+compatible_agents: [generic, claude, codex]
+notes: Requires an authenticated `gh` CLI. Zero-token, read-only.

package/jobs/finance/net-worth-snapshot.yaml

@@ -0,0 +1,33 @@
+id: net-worth-snapshot
+version: 1
+name: Net Worth Snapshot Reminder
+description: >
+  Reminds you to log your net worth each month and shows the trend from
+  your last two entries. Use this if you want to track your finances over
+  time but keep forgetting to actually sit down and do it.
+category: finance
+tags: [finance, net-worth, tracking]
+schedule: "0 9 1 * *"
+timezone: "UTC"
+runner: shell
+command: >
+  file={{net_worth_csv}};
+  [ -f "$file" ] || echo "date,net_worth" > "$file";
+  today=$(date +%F);
+  if tail -n +2 "$file" | cut -d, -f1 | grep -qx "$today"; then
+    echo "Already logged today.";
+  else
+    echo "$today," >> "$file";
+    echo "REMINDER: fill in today's net worth in $file";
+  fi;
+  prev=$(tail -n 2 "$file" | head -n 1 | cut -d, -f2);
+  last=$(tail -n 1 "$file" | cut -d, -f2);
+  [ -n "$prev" ] && [ -n "$last" ] && echo "Last entry: $last (previous: $prev)"; true
+variables:
+  net_worth_csv:
+    default: "./net-worth.csv"
+    description: CSV log file, one row per month (date,net_worth).
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Appends a blank row for you to fill in by hand — doesn't
+  pull balances from any bank automatically.

package/jobs/finance/saas-seat-audit.yaml

@@ -0,0 +1,35 @@
+id: saas-seat-audit
+version: 1
+name: Team SaaS Seat Audit
+description: >
+  Flags team SaaS seats (Slack, Notion, GitHub, etc.) nobody's actually
+  used in a while. Use this if you suspect you're paying for seats of
+  people who left or tools nobody opens anymore.
+category: finance
+tags: [saas, seats, team, budget]
+schedule: "0 9 1 * *"
+timezone: "UTC"
+runner: shell
+command: >
+  file={{seats_file}}; unused_days={{unused_days}};
+  [ -f "$file" ] || { echo "ERROR: $file not found"; exit 1; };
+  today=$(date +%s);
+  tail -n +2 "$file" | while IFS=, read -r tool owner cost last_active; do
+    last_epoch=$(date -j -f %Y-%m-%d "$last_active" +%s 2>/dev/null || date -d "$last_active" +%s);
+    days=$(( (today-last_epoch)/86400 ));
+    if [ "$days" -gt "$unused_days" ]; then echo "UNUSED SEAT: $tool - $owner (\$$cost/mo) - inactive $days days"; fi
+  done
+variables:
+  seats_file:
+    default: "./saas-seats.csv"
+    description: >
+      CSV with header "tool,seat_owner,monthly_cost,last_active_date"
+      (YYYY-MM-DD), one seat per row.
+  unused_days:
+    default: 30
+    description: Flag a seat if it hasn't been active in this many days.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token, deterministic. You maintain saas-seats.csv yourself (or
+  export last-active data from your SSO/IdP if it tracks that) — this job
+  only reads what's in the file, doesn't pull from any SaaS API.

package/jobs/finance/subscription-audit.yaml

@@ -0,0 +1,34 @@
+id: subscription-audit
+version: 1
+name: Subscription Audit
+description: >
+  Flags recurring subscriptions you haven't actually used in a while.
+  Use this if you suspect you're paying for things you forgot to cancel.
+category: finance
+tags: [subscriptions, budget, finance]
+schedule: "0 9 1 * *"
+timezone: "UTC"
+runner: shell
+command: >
+  file={{subs_file}}; unused_days={{unused_days}};
+  [ -f "$file" ] || { echo "ERROR: $file not found"; exit 1; };
+  today=$(date +%s);
+  tail -n +2 "$file" | while IFS=, read -r name cost last_used; do
+    last_epoch=$(date -j -f %Y-%m-%d "$last_used" +%s 2>/dev/null || date -d "$last_used" +%s);
+    days=$(( (today-last_epoch)/86400 ));
+    if [ "$days" -gt "$unused_days" ]; then echo "UNUSED: $name (\$$cost/mo) — not used in $days days"; fi
+  done
+variables:
+  subs_file:
+    default: "./subscriptions.csv"
+    description: >
+      CSV with header "name,monthly_cost,last_used_date" (YYYY-MM-DD), one
+      subscription per row.
+  unused_days:
+    default: 30
+    description: Flag a subscription if it hasn't been used in this many days.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token, deterministic. You maintain subs_file yourself (update
+  last_used_date when you actually use each service) — this job only
+  reads what's in the file, doesn't pull from any bank or card statement.

package/jobs/learning/course-progress-checkin.yaml

@@ -0,0 +1,37 @@
+id: course-progress-checkin
+version: 1
+name: Course Progress Check-in
+description: >
+  Compares your current chapter/lesson against a target date and tells
+  you if you're on track or falling behind. Use this if you've ever
+  signed up for a course and quietly stopped halfway through.
+category: learning
+tags: [learning, goals, progress]
+schedule: "0 9 * * 1"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  current={{current_chapter}}; target={{target_chapter}}; target_date={{target_date}};
+  today_epoch=$(date +%s);
+  target_epoch=$(date -j -f %Y-%m-%d "$target_date" +%s 2>/dev/null || date -d "$target_date" +%s);
+  days_left=$(( (target_epoch-today_epoch)/86400 ));
+  chapters_left=$(( target - current ));
+  if [ "$chapters_left" -le 0 ]; then echo "OK: at or past target chapter $target already.";
+  elif [ "$days_left" -le 0 ]; then echo "OVERDUE: target date was $target_date, still $chapters_left chapter(s) to go.";
+  elif [ "$chapters_left" -gt "$days_left" ]; then echo "BEHIND: $chapters_left chapter(s) left, only $days_left day(s) until $target_date.";
+  else echo "ON TRACK: $chapters_left chapter(s) left, $days_left day(s) until $target_date."; fi
+variables:
+  current_chapter:
+    default: 1
+    description: Chapter/lesson number you're currently on — update this yourself as you progress.
+  target_chapter:
+    default: 10
+    description: Chapter/lesson number you want to finish by target_date.
+  target_date:
+    default: "2026-12-31"
+    description: Date (YYYY-MM-DD) you want to hit target_chapter by.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. "Behind/on track" is a rough linear heuristic (chapters-left
+  vs. days-left), not a real study-pace model. You update current_chapter
+  yourself as you go.

package/jobs/learning/daily-flashcard-review.yaml

@@ -0,0 +1,29 @@
+id: daily-flashcard-review
+version: 1
+name: Daily Flashcard Review
+description: >
+  Lists which flashcards are due for review today from a simple deck
+  file. Use this if you're learning something with spaced repetition but
+  don't want a whole separate app for it.
+category: learning
+tags: [learning, flashcards, spaced-repetition]
+schedule: "0 8 * * *"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  deck={{deck_path}};
+  [ -f "$deck" ] || { echo "ERROR: $deck not found"; exit 1; };
+  today=$(date +%F);
+  due=$(awk -F, -v today="$today" 'NR>1 && $3<=today {print $1" -> "$2" (due "$3")"}' "$deck");
+  if [ -z "$due" ]; then echo "No cards due today.";
+  else echo "Cards due today:"; echo "$due"; fi
+variables:
+  deck_path:
+    default: "./flashcards.csv"
+    description: CSV with header "front,back,next_review_date" (YYYY-MM-DD).
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. You maintain flashcards.csv and update each card's
+  next_review_date yourself after reviewing — this is simple date-based
+  scheduling, not full SM-2 spaced repetition. This job only tells you
+  what's due, it doesn't reschedule cards for you.

package/jobs/learning/reading-list-nudge.yaml

@@ -0,0 +1,25 @@
+id: reading-list-nudge
+version: 1
+name: Reading List Nudge
+description: >
+  Reminds you what's next on your reading list. Use this if you save
+  articles/books to "read later" and later never comes.
+category: learning
+tags: [learning, reading, reminder]
+schedule: "0 9 * * 6"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  file={{reading_list_path}};
+  [ -f "$file" ] || { echo "ERROR: $file not found"; exit 1; };
+  next=$(head -n 1 "$file");
+  if [ -z "$next" ]; then echo "Reading list is empty — nice work.";
+  else echo "Next up: $next"; fi
+variables:
+  reading_list_path:
+    default: "./reading-list.txt"
+    description: Plain text file, one item per line — the top line is treated as "next."
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Suggests the top line only — remove an item from
+  reading-list.txt yourself once you've read it, or reorder to reprioritize.

package/jobs/personal/screen-time-check.yaml

@@ -0,0 +1,27 @@
+id: screen-time-check
+version: 1
+name: Screen Time Check
+description: >
+  Checks today's screen time against a goal and tells you if you're over.
+  Use this if you're trying to cut down on screen time but never actually
+  look at the stats your phone/laptop already collects.
+category: personal
+tags: [health, screen-time, wellbeing]
+schedule: "0 20 * * *"
+timezone: "America/Los_Angeles"
+runner: agent-prompt
+prompt: |
+  Check today's screen time against a {{daily_limit_hours}} hour goal.
+  1. Use whatever screen-time source you have access to (macOS Screen
+     Time, iOS Screen Time via Shortcuts, Android Digital Wellbeing,
+     RescueTime, etc.).
+  2. Report total screen time so far today vs. the goal.
+  3. If over goal, note the top 3 apps/categories driving it.
+variables:
+  daily_limit_hours:
+    default: 3
+    description: Daily screen time goal, in hours.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: >
+  No generic script mode — screen-time data access is platform/tool
+  specific and usually needs OS-level permissions your agent may not have.

package/jobs/personal/water-intake-reminder.yaml

@@ -0,0 +1,20 @@
+id: water-intake-reminder
+version: 1
+name: Water Intake Reminder
+description: >
+  Nudges you to drink water a few times a day toward a daily goal. Use
+  this if you sit at a desk all day and forget to drink water until
+  you've got a headache.
+category: personal
+tags: [health, hydration, reminder]
+schedule: "0 9,12,15,18 * * *"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  echo "Reminder: drink some water. Goal: {{daily_goal_oz}} oz today."
+variables:
+  daily_goal_oz:
+    default: 64
+    description: Your daily water intake goal, in ounces.
+compatible_agents: [generic, claude, codex]
+notes: Zero-token. Purely a nudge — doesn't track actual intake.

package/jobs/productivity/focus-block-reminder.yaml

@@ -0,0 +1,25 @@
+id: focus-block-reminder
+version: 1
+name: Focus Block Reminder
+description: >
+  Nudges you to start a deep-work block at set times. Use this if your
+  day fills up with reactive work and real focus time only happens by
+  accident.
+category: productivity
+tags: [focus, productivity, deep-work]
+schedule: "0 9,14 * * 1-5"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  echo "Focus block: {{block_minutes}} minutes on \"{{focus_task}}\" starting now. Silence notifications."
+variables:
+  focus_task:
+    default: "deep work"
+    description: What to focus on for this block.
+  block_minutes:
+    default: 50
+    description: Length of the focus block in minutes.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Purely a nudge — doesn't block notifications/apps itself;
+  pair with your OS's focus/DND mode if you want it enforced.

package/jobs/security/failed-login-watch.yaml

@@ -0,0 +1,37 @@
+id: failed-login-watch
+version: 1
+name: Failed Login Watch
+description: >
+  Watches an auth log for a burst of failed login attempts and alerts if
+  it crosses a threshold. Use this if you run a server exposed to SSH and
+  want an early warning for brute-force attempts.
+category: security
+tags: [security, auth, monitoring]
+schedule: "*/15 * * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  log={{auth_log_path}}; state={{state_file}}; threshold={{fail_threshold}};
+  [ -f "$log" ] || { echo "ERROR: $log not found"; exit 1; };
+  total=$(grep -c "Failed password" "$log");
+  last=$(cat "$state" 2>/dev/null || echo 0);
+  new=$(( total - last ));
+  [ "$new" -lt 0 ] && new=0;
+  echo "$total" > "$state";
+  if [ "$new" -ge "$threshold" ]; then echo "WARNING: $new new failed login attempt(s) since last check (threshold $threshold)"; exit 1;
+  else echo "OK: $new new failed login attempt(s) since last check"; fi
+variables:
+  auth_log_path:
+    default: "/var/log/auth.log"
+    description: Path to the auth log to watch (Linux-style).
+  state_file:
+    default: "./.failed-login-watch-state"
+    description: File this job uses to remember the last count seen, so it only alerts on new failures.
+  fail_threshold:
+    default: 5
+    description: Alert if this many new failed attempts appear since the last check.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Linux-oriented (/var/log/auth.log). On macOS, use
+  `log show --predicate 'eventMessage contains "authentication failure"'`
+  instead and adapt the command — this one won't work there as-is.

package/jobs/security/open-port-check.yaml

@@ -0,0 +1,36 @@
+id: open-port-check
+version: 1
+name: Expected Open Ports Check
+description: >
+  Checks that the ports you expect to be open on a host actually are, and
+  flags any that aren't. Use this if a service has ever silently stopped
+  listening and you found out from a user instead of a monitor.
+category: security
+tags: [security, network, ports]
+schedule: "0 */4 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  host={{host}}; fail=0;
+  for p in $(echo "{{expected_open_ports}}" | tr ',' ' '); do
+    if command -v nc >/dev/null 2>&1; then
+      nc -z -w2 "$host" "$p" 2>/dev/null && echo "OK: $host:$p open" || { echo "MISSING: $host:$p expected open but isn't"; fail=1; };
+    else
+      (echo > /dev/tcp/$host/$p) 2>/dev/null && echo "OK: $host:$p open" || { echo "MISSING: $host:$p expected open but isn't"; fail=1; };
+    fi
+  done;
+  exit $fail
+variables:
+  host:
+    default: "localhost"
+    description: Host to check.
+  expected_open_ports:
+    default: "22,80,443"
+    description: Comma-separated list of ports that should be open.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Checks only the ports you list — not a full port scan. Use
+  nmap for broader unexpected-open-port discovery. The nc branch (used on
+  virtually every system) is the tested path; the /dev/tcp fallback only
+  matters if nc is missing and requires bash specifically — it won't work
+  under dash/POSIX sh.

package/jobs/security/secrets-scan.yaml

@@ -0,0 +1,28 @@
+id: secrets-scan
+version: 1
+name: Committed Secrets Scan
+description: >
+  Scans a repo for accidentally committed API keys, tokens, and private
+  keys. Use this if you want a safety net for the "oops, committed a key"
+  mistake everyone makes eventually.
+category: security
+tags: [security, secrets, scanning]
+schedule: "0 3 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  cd {{repo_path}} &&
+  if command -v gitleaks >/dev/null 2>&1; then
+    gitleaks detect --source . --no-git -v;
+  else
+    echo "gitleaks not installed, falling back to basic pattern matching";
+    grep -rnE "(AKIA[0-9A-Z]{16}|-----BEGIN (RSA|EC|DSA|OPENSSH) PRIVATE KEY-----|api[_-]?key['\"]?[[:space:]]*[:=][[:space:]]*['\"][A-Za-z0-9_-]{16,})" --exclude-dir=.git --exclude-dir=node_modules . || echo "no matches found";
+  fi
+variables:
+  repo_path:
+    default: "."
+    description: Path to the repo to scan.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Prefers `gitleaks` if installed (far more accurate); the
+  fallback regex is best-effort and will miss many patterns or false-positive.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wonsukchoi/crondex",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "description": "A public directory of pre-made, agent-editable cron jobs.",
   "type": "module",
   "license": "MIT",