@wonsukchoi/crondex 0.2.0 → 0.3.0

package/README.md

@@ -60,7 +60,9 @@ crondex/
 │   ├── productivity/
 │   ├── personal/
 │   ├── content/
-│   └── finance/
+│   ├── finance/
+│   ├── security/
+│   └── learning/
 └── scripts/
     ├── build-catalog.js   regenerates catalog.json from jobs/**/*.yaml
     └── validate-jobs.js   validates every job against the schema
@@ -68,7 +70,7 @@ crondex/
 
 ## Available jobs
 
-24 jobs across 5 categories. Full details (description, tags, variables)
+35 jobs across 7 categories. Full details (description, tags, variables)
 live in `catalog.json` and each job's YAML file — run `crondex list` or
 browse `jobs/<category>/` for the plain-language rundown of each.
 
@@ -87,6 +89,9 @@ browse `jobs/<category>/` for the plain-language rundown of each.
 | `docker-image-prune` | `0 4 * * *` | script |
 | `env-drift-check` | `0 8 * * *` | script |
 | `stale-dependency-pr-nudge` | `0 9 * * 1-5` | script |
+| `db-backup-verify` | `0 5 * * *` | script |
+| `license-compliance-check` | `0 8 * * 1` | script |
+| `orphaned-branch-cleanup` | `0 9 * * 1` | script |
 
 **productivity**
 
@@ -95,6 +100,7 @@ browse `jobs/<category>/` for the plain-language rundown of each.
 | `daily-standup-summary` | `0 8 * * 1-5` | script + agent-prompt |
 | `inbox-triage` | `0 7,13 * * 1-5` | agent-prompt only |
 | `weekly-report` | `0 16 * * 5` | script + agent-prompt |
+| `focus-block-reminder` | `0 9,14 * * 1-5` | script |
 
 **personal**
 
@@ -120,6 +126,23 @@ browse `jobs/<category>/` for the plain-language rundown of each.
 |---|---|---|
 | `subscription-audit` | `0 9 1 * *` | script |
 | `net-worth-snapshot` | `0 9 1 * *` | script |
+| `saas-seat-audit` | `0 9 1 * *` | script |
+
+**security**
+
+| id | schedule | modes |
+|---|---|---|
+| `secrets-scan` | `0 3 * * *` | script |
+| `open-port-check` | `0 */4 * * *` | script |
+| `failed-login-watch` | `*/15 * * * *` | script |
+
+**learning**
+
+| id | schedule | modes |
+|---|---|---|
+| `daily-flashcard-review` | `0 8 * * *` | script |
+| `reading-list-nudge` | `0 9 * * 6` | script |
+| `course-progress-checkin` | `0 9 * * 1` | script |
 
 ## How a job works
 

package/catalog.json

@@ -1,7 +1,7 @@
 {
   "generated_by": "scripts/build-catalog.js",
   "schema": "schema/job.schema.json",
-  "count": 24,
+  "count": 35,
   "jobs": [
     {
       "id": "backup-reminder",
@@ -129,6 +129,54 @@
       ],
       "path": "jobs/devops/cost-alert.yaml"
     },
+    {
+      "id": "course-progress-checkin",
+      "version": 1,
+      "name": "Course Progress Check-in",
+      "description": "Compares your current chapter/lesson against a target date and tells you if you're on track or falling behind. Use this if you've ever signed up for a course and quietly stopped halfway through.",
+      "category": "learning",
+      "tags": [
+        "learning",
+        "goals",
+        "progress"
+      ],
+      "schedule": "0 9 * * 1",
+      "timezone": "America/Los_Angeles",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/learning/course-progress-checkin.yaml"
+    },
+    {
+      "id": "daily-flashcard-review",
+      "version": 1,
+      "name": "Daily Flashcard Review",
+      "description": "Lists which flashcards are due for review today from a simple deck file. Use this if you're learning something with spaced repetition but don't want a whole separate app for it.",
+      "category": "learning",
+      "tags": [
+        "learning",
+        "flashcards",
+        "spaced-repetition"
+      ],
+      "schedule": "0 8 * * *",
+      "timezone": "America/Los_Angeles",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/learning/daily-flashcard-review.yaml"
+    },
     {
       "id": "daily-standup-summary",
       "version": 1,
@@ -156,6 +204,30 @@
       ],
       "path": "jobs/productivity/daily-standup-summary.yaml"
     },
+    {
+      "id": "db-backup-verify",
+      "version": 1,
+      "name": "Database Backup Restore Verification",
+      "description": "Actually restores your latest database backup to a throwaway database and checks it's queryable. Use this if `backup-reminder` isn't enough — a backup file existing doesn't mean it's actually restorable.",
+      "category": "devops",
+      "tags": [
+        "database",
+        "backup",
+        "postgres"
+      ],
+      "schedule": "0 5 * * *",
+      "timezone": "UTC",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/devops/db-backup-verify.yaml"
+    },
     {
       "id": "dependency-audit",
       "version": 1,
@@ -255,6 +327,54 @@
       ],
       "path": "jobs/devops/env-drift-check.yaml"
     },
+    {
+      "id": "failed-login-watch",
+      "version": 1,
+      "name": "Failed Login Watch",
+      "description": "Watches an auth log for a burst of failed login attempts and alerts if it crosses a threshold. Use this if you run a server exposed to SSH and want an early warning for brute-force attempts.",
+      "category": "security",
+      "tags": [
+        "security",
+        "auth",
+        "monitoring"
+      ],
+      "schedule": "*/15 * * * *",
+      "timezone": "UTC",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/security/failed-login-watch.yaml"
+    },
+    {
+      "id": "focus-block-reminder",
+      "version": 1,
+      "name": "Focus Block Reminder",
+      "description": "Nudges you to start a deep-work block at set times. Use this if your day fills up with reactive work and real focus time only happens by accident.",
+      "category": "productivity",
+      "tags": [
+        "focus",
+        "productivity",
+        "deep-work"
+      ],
+      "schedule": "0 9,14 * * 1-5",
+      "timezone": "America/Los_Angeles",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/productivity/focus-block-reminder.yaml"
+    },
     {
       "id": "habit-checkin",
       "version": 1,
@@ -305,6 +425,30 @@
       ],
       "path": "jobs/productivity/inbox-triage.yaml"
     },
+    {
+      "id": "license-compliance-check",
+      "version": 1,
+      "name": "Dependency License Compliance Check",
+      "description": "Scans your dependencies for licenses you've flagged as risky (like GPL or AGPL). Use this if you've ever shipped something and only later found out a dependency's license doesn't play well with your product.",
+      "category": "devops",
+      "tags": [
+        "license",
+        "compliance",
+        "dependencies"
+      ],
+      "schedule": "0 8 * * 1",
+      "timezone": "UTC",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/devops/license-compliance-check.yaml"
+    },
     {
       "id": "log-cleanup",
       "version": 1,
@@ -379,6 +523,78 @@
       ],
       "path": "jobs/finance/net-worth-snapshot.yaml"
     },
+    {
+      "id": "open-port-check",
+      "version": 1,
+      "name": "Expected Open Ports Check",
+      "description": "Checks that the ports you expect to be open on a host actually are, and flags any that aren't. Use this if a service has ever silently stopped listening and you found out from a user instead of a monitor.",
+      "category": "security",
+      "tags": [
+        "security",
+        "network",
+        "ports"
+      ],
+      "schedule": "0 */4 * * *",
+      "timezone": "UTC",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/security/open-port-check.yaml"
+    },
+    {
+      "id": "orphaned-branch-cleanup",
+      "version": 1,
+      "name": "Orphaned Branch Cleanup",
+      "description": "Lists remote branches already merged into main that nobody's deleted yet. Use this if your branch list has become a graveyard nobody wants to clean up.",
+      "category": "devops",
+      "tags": [
+        "git",
+        "cleanup",
+        "branches"
+      ],
+      "schedule": "0 9 * * 1",
+      "timezone": "UTC",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/devops/orphaned-branch-cleanup.yaml"
+    },
+    {
+      "id": "reading-list-nudge",
+      "version": 1,
+      "name": "Reading List Nudge",
+      "description": "Reminds you what's next on your reading list. Use this if you save articles/books to \"read later\" and later never comes.",
+      "category": "learning",
+      "tags": [
+        "learning",
+        "reading",
+        "reminder"
+      ],
+      "schedule": "0 9 * * 6",
+      "timezone": "America/Los_Angeles",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/learning/reading-list-nudge.yaml"
+    },
     {
       "id": "repo-health-check",
       "version": 1,
@@ -406,6 +622,31 @@
       ],
       "path": "jobs/devops/repo-health-check.yaml"
     },
+    {
+      "id": "saas-seat-audit",
+      "version": 1,
+      "name": "Team SaaS Seat Audit",
+      "description": "Flags team SaaS seats (Slack, Notion, GitHub, etc.) nobody's actually used in a while. Use this if you suspect you're paying for seats of people who left or tools nobody opens anymore.",
+      "category": "finance",
+      "tags": [
+        "saas",
+        "seats",
+        "team",
+        "budget"
+      ],
+      "schedule": "0 9 1 * *",
+      "timezone": "UTC",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/finance/saas-seat-audit.yaml"
+    },
     {
       "id": "screen-time-check",
       "version": 1,
@@ -432,6 +673,30 @@
       ],
       "path": "jobs/personal/screen-time-check.yaml"
     },
+    {
+      "id": "secrets-scan",
+      "version": 1,
+      "name": "Committed Secrets Scan",
+      "description": "Scans a repo for accidentally committed API keys, tokens, and private keys. Use this if you want a safety net for the \"oops, committed a key\" mistake everyone makes eventually.",
+      "category": "security",
+      "tags": [
+        "security",
+        "secrets",
+        "scanning"
+      ],
+      "schedule": "0 3 * * *",
+      "timezone": "UTC",
+      "runner": "shell",
+      "modes": [
+        "script"
+      ],
+      "compatible_agents": [
+        "generic",
+        "claude",
+        "codex"
+      ],
+      "path": "jobs/security/secrets-scan.yaml"
+    },
     {
       "id": "social-mentions-watch",
       "version": 1,

package/jobs/devops/db-backup-verify.yaml

@@ -0,0 +1,37 @@
+id: db-backup-verify
+version: 1
+name: Database Backup Restore Verification
+description: >
+  Actually restores your latest database backup to a throwaway database
+  and checks it's queryable. Use this if `backup-reminder` isn't enough —
+  a backup file existing doesn't mean it's actually restorable.
+category: devops
+tags: [database, backup, postgres]
+schedule: "0 5 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  dump={{dump_path}}; scratch_db={{scratch_db_name}};
+  [ -f "$dump" ] || { echo "ERROR: $dump not found"; exit 1; };
+  command -v pg_restore >/dev/null 2>&1 || { echo "ERROR: pg_restore not installed"; exit 1; };
+  dropdb --if-exists "$scratch_db" 2>/dev/null;
+  createdb "$scratch_db" || { echo "ERROR: could not create scratch db $scratch_db"; exit 1; };
+  pg_restore -d "$scratch_db" "$dump" >/dev/null 2>&1;
+  count=$(psql -d "$scratch_db" -tAc "SELECT count(*) FROM {{checkpoint_table}}" 2>/dev/null);
+  dropdb --if-exists "$scratch_db" 2>/dev/null;
+  if [ -z "$count" ]; then echo "FAILED: restore or query failed on $dump"; exit 1;
+  else echo "OK: restored $dump, $checkpoint_table has $count rows"; fi
+variables:
+  dump_path:
+    default: "./backups/latest.dump"
+    description: Path to the pg_dump/pg_restore-format backup file.
+  scratch_db_name:
+    default: "backup_verify_scratch"
+    description: Throwaway database name used for the test restore (created and dropped each run).
+  checkpoint_table:
+    default: "users"
+    description: A table expected to have rows — used to confirm the restore actually worked.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Postgres-specific (pg_restore/psql/createdb/dropdb) — adapt the command
+  for other database engines. Needs CREATE/DROP DATABASE privileges.

package/jobs/devops/license-compliance-check.yaml

@@ -0,0 +1,31 @@
+id: license-compliance-check
+version: 1
+name: Dependency License Compliance Check
+description: >
+  Scans your dependencies for licenses you've flagged as risky (like GPL
+  or AGPL). Use this if you've ever shipped something and only later
+  found out a dependency's license doesn't play well with your product.
+category: devops
+tags: [license, compliance, dependencies]
+schedule: "0 8 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  cd {{repo_path}} &&
+  if [ -f package.json ]; then
+    npx --yes license-checker --summary --excludePrivatePackages 2>/dev/null | grep -iE "{{flagged_licenses}}" && echo "^ flagged licenses found above" || echo "OK: no flagged licenses found";
+  else
+    echo "no package.json found — this job only supports npm/Node projects currently";
+  fi
+variables:
+  repo_path:
+    default: "."
+    description: Path to the repo to check.
+  flagged_licenses:
+    default: "GPL|AGPL"
+    description: Regex alternation of license names to flag.
+compatible_agents: [generic, claude, codex]
+notes: >
+  npm/Node projects only (uses `npx license-checker`, downloads on first
+  run). For other ecosystems, swap in the equivalent tool
+  (pip-licenses, cargo-license, etc.) and adjust the command.

package/jobs/devops/orphaned-branch-cleanup.yaml

@@ -0,0 +1,28 @@
+id: orphaned-branch-cleanup
+version: 1
+name: Orphaned Branch Cleanup
+description: >
+  Lists remote branches already merged into main that nobody's deleted
+  yet. Use this if your branch list has become a graveyard nobody wants
+  to clean up.
+category: devops
+tags: [git, cleanup, branches]
+schedule: "0 9 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  cd {{repo_path}} && git fetch --prune >/dev/null 2>&1;
+  merged=$(git branch -r --merged {{base_branch}} | grep -v -E "(\*|{{base_branch}}$)" | sed 's#origin/##');
+  if [ -z "$merged" ]; then echo "OK: no merged branches to clean up";
+  else echo "Merged into {{base_branch}}, safe to delete:"; echo "$merged"; fi
+variables:
+  repo_path:
+    default: "."
+    description: Path to the repo to check.
+  base_branch:
+    default: "main"
+    description: Branch to check merges against.
+compatible_agents: [generic, claude, codex]
+notes: >
+  List-only by design — never deletes anything. Review the list, then
+  `git push origin --delete <branch>` yourself for ones you actually want gone.

package/jobs/finance/saas-seat-audit.yaml

@@ -0,0 +1,35 @@
+id: saas-seat-audit
+version: 1
+name: Team SaaS Seat Audit
+description: >
+  Flags team SaaS seats (Slack, Notion, GitHub, etc.) nobody's actually
+  used in a while. Use this if you suspect you're paying for seats of
+  people who left or tools nobody opens anymore.
+category: finance
+tags: [saas, seats, team, budget]
+schedule: "0 9 1 * *"
+timezone: "UTC"
+runner: shell
+command: >
+  file={{seats_file}}; unused_days={{unused_days}};
+  [ -f "$file" ] || { echo "ERROR: $file not found"; exit 1; };
+  today=$(date +%s);
+  tail -n +2 "$file" | while IFS=, read -r tool owner cost last_active; do
+    last_epoch=$(date -j -f %Y-%m-%d "$last_active" +%s 2>/dev/null || date -d "$last_active" +%s);
+    days=$(( (today-last_epoch)/86400 ));
+    if [ "$days" -gt "$unused_days" ]; then echo "UNUSED SEAT: $tool - $owner (\$$cost/mo) - inactive $days days"; fi
+  done
+variables:
+  seats_file:
+    default: "./saas-seats.csv"
+    description: >
+      CSV with header "tool,seat_owner,monthly_cost,last_active_date"
+      (YYYY-MM-DD), one seat per row.
+  unused_days:
+    default: 30
+    description: Flag a seat if it hasn't been active in this many days.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token, deterministic. You maintain saas-seats.csv yourself (or
+  export last-active data from your SSO/IdP if it tracks that) — this job
+  only reads what's in the file, doesn't pull from any SaaS API.

package/jobs/learning/course-progress-checkin.yaml

@@ -0,0 +1,37 @@
+id: course-progress-checkin
+version: 1
+name: Course Progress Check-in
+description: >
+  Compares your current chapter/lesson against a target date and tells
+  you if you're on track or falling behind. Use this if you've ever
+  signed up for a course and quietly stopped halfway through.
+category: learning
+tags: [learning, goals, progress]
+schedule: "0 9 * * 1"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  current={{current_chapter}}; target={{target_chapter}}; target_date={{target_date}};
+  today_epoch=$(date +%s);
+  target_epoch=$(date -j -f %Y-%m-%d "$target_date" +%s 2>/dev/null || date -d "$target_date" +%s);
+  days_left=$(( (target_epoch-today_epoch)/86400 ));
+  chapters_left=$(( target - current ));
+  if [ "$chapters_left" -le 0 ]; then echo "OK: at or past target chapter $target already.";
+  elif [ "$days_left" -le 0 ]; then echo "OVERDUE: target date was $target_date, still $chapters_left chapter(s) to go.";
+  elif [ "$chapters_left" -gt "$days_left" ]; then echo "BEHIND: $chapters_left chapter(s) left, only $days_left day(s) until $target_date.";
+  else echo "ON TRACK: $chapters_left chapter(s) left, $days_left day(s) until $target_date."; fi
+variables:
+  current_chapter:
+    default: 1
+    description: Chapter/lesson number you're currently on — update this yourself as you progress.
+  target_chapter:
+    default: 10
+    description: Chapter/lesson number you want to finish by target_date.
+  target_date:
+    default: "2026-12-31"
+    description: Date (YYYY-MM-DD) you want to hit target_chapter by.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. "Behind/on track" is a rough linear heuristic (chapters-left
+  vs. days-left), not a real study-pace model. You update current_chapter
+  yourself as you go.

package/jobs/learning/daily-flashcard-review.yaml

@@ -0,0 +1,29 @@
+id: daily-flashcard-review
+version: 1
+name: Daily Flashcard Review
+description: >
+  Lists which flashcards are due for review today from a simple deck
+  file. Use this if you're learning something with spaced repetition but
+  don't want a whole separate app for it.
+category: learning
+tags: [learning, flashcards, spaced-repetition]
+schedule: "0 8 * * *"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  deck={{deck_path}};
+  [ -f "$deck" ] || { echo "ERROR: $deck not found"; exit 1; };
+  today=$(date +%F);
+  due=$(awk -F, -v today="$today" 'NR>1 && $3<=today {print $1" -> "$2" (due "$3")"}' "$deck");
+  if [ -z "$due" ]; then echo "No cards due today.";
+  else echo "Cards due today:"; echo "$due"; fi
+variables:
+  deck_path:
+    default: "./flashcards.csv"
+    description: CSV with header "front,back,next_review_date" (YYYY-MM-DD).
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. You maintain flashcards.csv and update each card's
+  next_review_date yourself after reviewing — this is simple date-based
+  scheduling, not full SM-2 spaced repetition. This job only tells you
+  what's due, it doesn't reschedule cards for you.

package/jobs/learning/reading-list-nudge.yaml

@@ -0,0 +1,25 @@
+id: reading-list-nudge
+version: 1
+name: Reading List Nudge
+description: >
+  Reminds you what's next on your reading list. Use this if you save
+  articles/books to "read later" and later never comes.
+category: learning
+tags: [learning, reading, reminder]
+schedule: "0 9 * * 6"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  file={{reading_list_path}};
+  [ -f "$file" ] || { echo "ERROR: $file not found"; exit 1; };
+  next=$(head -n 1 "$file");
+  if [ -z "$next" ]; then echo "Reading list is empty — nice work.";
+  else echo "Next up: $next"; fi
+variables:
+  reading_list_path:
+    default: "./reading-list.txt"
+    description: Plain text file, one item per line — the top line is treated as "next."
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Suggests the top line only — remove an item from
+  reading-list.txt yourself once you've read it, or reorder to reprioritize.

package/jobs/productivity/focus-block-reminder.yaml

@@ -0,0 +1,25 @@
+id: focus-block-reminder
+version: 1
+name: Focus Block Reminder
+description: >
+  Nudges you to start a deep-work block at set times. Use this if your
+  day fills up with reactive work and real focus time only happens by
+  accident.
+category: productivity
+tags: [focus, productivity, deep-work]
+schedule: "0 9,14 * * 1-5"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  echo "Focus block: {{block_minutes}} minutes on \"{{focus_task}}\" starting now. Silence notifications."
+variables:
+  focus_task:
+    default: "deep work"
+    description: What to focus on for this block.
+  block_minutes:
+    default: 50
+    description: Length of the focus block in minutes.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Purely a nudge — doesn't block notifications/apps itself;
+  pair with your OS's focus/DND mode if you want it enforced.

package/jobs/security/failed-login-watch.yaml

@@ -0,0 +1,37 @@
+id: failed-login-watch
+version: 1
+name: Failed Login Watch
+description: >
+  Watches an auth log for a burst of failed login attempts and alerts if
+  it crosses a threshold. Use this if you run a server exposed to SSH and
+  want an early warning for brute-force attempts.
+category: security
+tags: [security, auth, monitoring]
+schedule: "*/15 * * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  log={{auth_log_path}}; state={{state_file}}; threshold={{fail_threshold}};
+  [ -f "$log" ] || { echo "ERROR: $log not found"; exit 1; };
+  total=$(grep -c "Failed password" "$log");
+  last=$(cat "$state" 2>/dev/null || echo 0);
+  new=$(( total - last ));
+  [ "$new" -lt 0 ] && new=0;
+  echo "$total" > "$state";
+  if [ "$new" -ge "$threshold" ]; then echo "WARNING: $new new failed login attempt(s) since last check (threshold $threshold)"; exit 1;
+  else echo "OK: $new new failed login attempt(s) since last check"; fi
+variables:
+  auth_log_path:
+    default: "/var/log/auth.log"
+    description: Path to the auth log to watch (Linux-style).
+  state_file:
+    default: "./.failed-login-watch-state"
+    description: File this job uses to remember the last count seen, so it only alerts on new failures.
+  fail_threshold:
+    default: 5
+    description: Alert if this many new failed attempts appear since the last check.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Linux-oriented (/var/log/auth.log). On macOS, use
+  `log show --predicate 'eventMessage contains "authentication failure"'`
+  instead and adapt the command — this one won't work there as-is.

package/jobs/security/open-port-check.yaml

@@ -0,0 +1,36 @@
+id: open-port-check
+version: 1
+name: Expected Open Ports Check
+description: >
+  Checks that the ports you expect to be open on a host actually are, and
+  flags any that aren't. Use this if a service has ever silently stopped
+  listening and you found out from a user instead of a monitor.
+category: security
+tags: [security, network, ports]
+schedule: "0 */4 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  host={{host}}; fail=0;
+  for p in $(echo "{{expected_open_ports}}" | tr ',' ' '); do
+    if command -v nc >/dev/null 2>&1; then
+      nc -z -w2 "$host" "$p" 2>/dev/null && echo "OK: $host:$p open" || { echo "MISSING: $host:$p expected open but isn't"; fail=1; };
+    else
+      (echo > /dev/tcp/$host/$p) 2>/dev/null && echo "OK: $host:$p open" || { echo "MISSING: $host:$p expected open but isn't"; fail=1; };
+    fi
+  done;
+  exit $fail
+variables:
+  host:
+    default: "localhost"
+    description: Host to check.
+  expected_open_ports:
+    default: "22,80,443"
+    description: Comma-separated list of ports that should be open.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Checks only the ports you list — not a full port scan. Use
+  nmap for broader unexpected-open-port discovery. The nc branch (used on
+  virtually every system) is the tested path; the /dev/tcp fallback only
+  matters if nc is missing and requires bash specifically — it won't work
+  under dash/POSIX sh.

package/jobs/security/secrets-scan.yaml

@@ -0,0 +1,28 @@
+id: secrets-scan
+version: 1
+name: Committed Secrets Scan
+description: >
+  Scans a repo for accidentally committed API keys, tokens, and private
+  keys. Use this if you want a safety net for the "oops, committed a key"
+  mistake everyone makes eventually.
+category: security
+tags: [security, secrets, scanning]
+schedule: "0 3 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  cd {{repo_path}} &&
+  if command -v gitleaks >/dev/null 2>&1; then
+    gitleaks detect --source . --no-git -v;
+  else
+    echo "gitleaks not installed, falling back to basic pattern matching";
+    grep -rnE "(AKIA[0-9A-Z]{16}|-----BEGIN (RSA|EC|DSA|OPENSSH) PRIVATE KEY-----|api[_-]?key['\"]?[[:space:]]*[:=][[:space:]]*['\"][A-Za-z0-9_-]{16,})" --exclude-dir=.git --exclude-dir=node_modules . || echo "no matches found";
+  fi
+variables:
+  repo_path:
+    default: "."
+    description: Path to the repo to scan.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Prefers `gitleaks` if installed (far more accurate); the
+  fallback regex is best-effort and will miss many patterns or false-positive.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wonsukchoi/crondex",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "A public directory of pre-made, agent-editable cron jobs.",
   "type": "module",
   "license": "MIT",