@wonsukchoi/crondex 0.5.0 → 0.6.0

package/jobs/content/sitemap-freshness-check.yaml

@@ -0,0 +1,31 @@
+id: sitemap-freshness-check
+version: 1
+name: Sitemap Freshness Check
+description: >
+  Checks that your sitemap.xml was actually regenerated recently and isn't
+  quietly stuck on an old snapshot. Use this if your sitemap is generated
+  by a build step that's ever silently failed or skipped.
+category: content
+tags: [seo, sitemap, freshness]
+schedule: "0 7 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  lastmod=$(curl -s {{sitemap_url}} | grep -o '<lastmod>[^<]*' | sed 's/<lastmod>//' | sort -r | head -n1);
+  if [ -z "$lastmod" ]; then echo "WARNING: could not find any <lastmod> entries in {{sitemap_url}}"; exit 1;
+  else
+    lastmod_ts=$(date -d "$lastmod" +%s 2>/dev/null || date -jf "%Y-%m-%d" "${lastmod%%T*}" +%s 2>/dev/null);
+    now_ts=$(date +%s);
+    age_days=$(( (now_ts - lastmod_ts) / 86400 ));
+    if [ "$age_days" -ge "{{max_age_days}}" ]; then echo "WARNING: newest sitemap entry is $age_days days old"; exit 1;
+    else echo "OK: newest sitemap entry is $age_days days old"; fi
+  fi
+variables:
+  sitemap_url:
+    default: "https://example.com/sitemap.xml"
+    description: URL of the sitemap to check.
+  max_age_days:
+    default: 14
+    description: Days since the newest lastmod entry before it's flagged stale.
+compatible_agents: [generic, claude, codex]
+notes: Assumes at least one <lastmod> tag exists in the sitemap; sitemap index files with nested sitemaps aren't followed.

package/jobs/content/stale-post-audit.yaml

@@ -0,0 +1,28 @@
+id: stale-post-audit
+version: 1
+name: Stale Post Audit
+description: >
+  Flags published posts that haven't been touched in a long time, as
+  candidates for a refresh. Use this if old content quietly rots (dead
+  screenshots, outdated advice) while still ranking and getting traffic.
+category: content
+tags: [content, seo, maintenance]
+schedule: "0 8 1 * *"
+timezone: "UTC"
+runner: agent-prompt
+prompt: |
+  Review posts/pages under {{content_dir}}.
+  1. For each, find the last modified date (git log or frontmatter date).
+  2. Flag any not updated in more than {{stale_months}} months.
+  3. For the flagged ones, note anything obviously outdated (broken
+     screenshots, version numbers, dead links) if visible in the content.
+  4. Report the list ranked oldest-first.
+variables:
+  content_dir:
+    default: "content/posts"
+    description: Directory containing published content.
+  stale_months:
+    default: 12
+    description: Months since last update before a post is flagged.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: No generic script mode — "last modified" via git log is easy in shell, but judging what's outdated needs an agent reading the content.

package/jobs/devops/error-rate-spike-watch.yaml

@@ -0,0 +1,43 @@
+id: error-rate-spike-watch
+version: 1
+name: Error Rate Spike Watch
+description: >
+  Checks your error tracker's recent error count against a threshold and
+  flags a spike. Use this if a bad deploy has ever quietly spiked errors
+  for hours before anyone noticed.
+category: devops
+tags: [errors, monitoring, alerting]
+schedule: "*/15 * * * *"
+timezone: "UTC"
+runner: hybrid
+command: >
+  if [ -n "$SENTRY_AUTH_TOKEN" ] && [ -n "{{sentry_project}}" ]; then
+    count=$(curl -s -H "Authorization: Bearer $SENTRY_AUTH_TOKEN" "https://sentry.io/api/0/projects/{{sentry_org}}/{{sentry_project}}/events/?statsPeriod=15m" | grep -o '"id"' | wc -l | tr -d ' ');
+    if [ "$count" -ge "{{threshold}}" ]; then echo "WARNING: $count errors in last 15m (threshold {{threshold}})"; exit 1;
+    else echo "OK: $count errors in last 15m"; fi
+  else
+    echo "SENTRY_AUTH_TOKEN or sentry_project not set — use agent-prompt mode instead";
+  fi
+prompt: |
+  Check the error tracker (Sentry, Rollbar, Bugsnag, or whatever this
+  project uses) for {{sentry_project}} over the last 15 minutes.
+  1. Compare current error volume to the typical rate for this time of day.
+  2. If it's spiking (well above {{threshold}} events, or a clear anomaly
+     vs. baseline), alert with the top offending error and when it started.
+  3. If normal, report the count in one line.
+script_note: >
+  `command` only supports Sentry's REST API with a raw event count
+  threshold. `prompt` works with any error tracker and can reason about
+  baseline vs. anomaly instead of a flat threshold.
+variables:
+  sentry_org:
+    default: "your-org"
+    description: Sentry organization slug.
+  sentry_project:
+    default: "your-project"
+    description: Sentry project slug.
+  threshold:
+    default: 50
+    description: Error count in the window that counts as a spike.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: Script mode needs SENTRY_AUTH_TOKEN in the environment; scoped read access to project events is enough.

package/jobs/devops/feature-flag-staleness-audit.yaml

@@ -0,0 +1,30 @@
+id: feature-flag-staleness-audit
+version: 1
+name: Feature Flag Staleness Audit
+description: >
+  Flags feature flags that have been at 100% (or 0%) rollout for a long
+  time and never cleaned up. Use this if your flag list has become a
+  graveyard of decisions nobody removed the scaffolding for.
+category: devops
+tags: [feature-flags, cleanup, tech-debt]
+schedule: "0 9 * * 1"
+timezone: "UTC"
+runner: agent-prompt
+prompt: |
+  Audit feature flags in {{flag_provider_hint}} (or the flags config file
+  in this repo if flags are managed in code).
+  1. List flags that have been fully rolled out (100%) or fully killed (0%)
+     for more than {{stale_days}} days.
+  2. For each, note whether the flag and its dead branch are still
+     referenced in code.
+  3. Report the list, ranked by how long they've been stale, as candidates
+     for removal.
+variables:
+  flag_provider_hint:
+    default: "LaunchDarkly"
+    description: Name of the feature flag system/provider in use (e.g. LaunchDarkly, Unleash, in-repo config).
+  stale_days:
+    default: 60
+    description: Days at a terminal rollout state before a flag counts as stale.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: No generic script mode — flag providers have wildly different APIs, and "still referenced in code" needs a code-aware agent.

package/jobs/devops/terraform-drift-check.yaml

@@ -0,0 +1,24 @@
+id: terraform-drift-check
+version: 1
+name: Terraform Drift Check
+description: >
+  Runs a Terraform plan and flags it if there's drift between your state
+  and actual infrastructure. Use this if you've ever had someone click
+  around in a cloud console and quietly break parity with your IaC.
+category: devops
+tags: [terraform, infrastructure, drift]
+schedule: "0 7 * * 1-5"
+timezone: "UTC"
+runner: shell
+command: >
+  cd {{terraform_dir}} && terraform plan -detailed-exitcode -no-color -input=false > /tmp/tf-plan.out 2>&1;
+  code=$?;
+  if [ "$code" -eq 2 ]; then echo "DRIFT DETECTED in {{terraform_dir}}:"; tail -n 40 /tmp/tf-plan.out; exit 1;
+  elif [ "$code" -eq 0 ]; then echo "OK: no drift in {{terraform_dir}}";
+  else echo "ERROR: terraform plan failed"; tail -n 40 /tmp/tf-plan.out; exit 1; fi
+variables:
+  terraform_dir:
+    default: "."
+    description: Path to the Terraform root module to check.
+compatible_agents: [generic, claude, codex]
+notes: Requires terraform CLI and valid provider credentials already configured in the environment.

package/jobs/finance/budget-overspend-check.yaml

@@ -0,0 +1,29 @@
+id: budget-overspend-check
+version: 1
+name: Budget Overspend Check
+description: >
+  Compares this month's spend in a budget category against your limit and
+  warns if you're over. Use this if you set budgets once and then never
+  actually check them until the month's already blown.
+category: finance
+tags: [budget, spending, finance]
+schedule: "0 9 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  spent=$(awk -F, -v month="$(date +%Y-%m)" -v cat="{{category}}" '$1 ~ month && $2 == cat {sum += $3} END {print sum+0}' {{transactions_csv}});
+  limit={{budget_limit}};
+  if awk "BEGIN{exit !($spent >= $limit)}"; then echo "WARNING: {{category}} spend \$$spent has hit/exceeded budget \$$limit this month"; exit 1;
+  else echo "OK: {{category}} spend \$$spent, budget \$$limit"; fi
+variables:
+  transactions_csv:
+    default: "transactions.csv"
+    description: "CSV of transactions with columns: date(YYYY-MM-DD),category,amount."
+  category:
+    default: "dining"
+    description: Budget category to check.
+  budget_limit:
+    default: 300
+    description: Monthly budget limit for this category, in your currency.
+compatible_agents: [generic, claude, codex]
+notes: Expects a plain CSV export; point transactions_csv at wherever your bank/budgeting tool exports to.

package/jobs/finance/fx-rate-watch.yaml

@@ -0,0 +1,33 @@
+id: fx-rate-watch
+version: 1
+name: FX Rate Watch
+description: >
+  Checks a currency pair's exchange rate and alerts when it crosses a
+  threshold you set. Use this if you're timing a transfer, payment, or
+  purchase around a favorable rate and don't want to check manually every day.
+category: finance
+tags: [finance, currency, fx]
+schedule: "0 8 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  rate=$(curl -s "https://api.exchangerate.host/latest?base={{from_currency}}&symbols={{to_currency}}" | grep -o '"{{to_currency}}":[0-9.]*' | cut -d: -f2);
+  if [ -z "$rate" ]; then echo "ERROR: could not fetch rate for {{from_currency}}/{{to_currency}}"; exit 1; fi;
+  if awk "BEGIN{exit !($rate {{comparison}} {{target_rate}})}"; then
+    echo "ALERT: {{from_currency}}/{{to_currency}} is $rate ({{comparison}} {{target_rate}})";
+  else echo "OK: {{from_currency}}/{{to_currency}} is $rate"; fi
+variables:
+  from_currency:
+    default: "USD"
+    description: Base currency code.
+  to_currency:
+    default: "EUR"
+    description: Target currency code.
+  target_rate:
+    default: 0.95
+    description: Threshold rate to compare against.
+  comparison:
+    default: "<="
+    description: "Comparison operator for triggering the alert: <=, >=, <, or >."
+compatible_agents: [generic, claude, codex]
+notes: Uses the free exchangerate.host API; swap in another FX API if you need higher rate limits or historical accuracy.

package/jobs/growth/churn-risk-watch.yaml

@@ -0,0 +1,33 @@
+id: churn-risk-watch
+version: 1
+name: Churn Risk Watch
+description: >
+  Flags accounts whose usage has dropped off sharply, before they actually
+  cancel. Use this if you only ever find out someone churned after the
+  cancellation email arrives.
+category: growth
+tags: [growth, churn, retention]
+schedule: "0 9 * * 1"
+timezone: "UTC"
+runner: agent-prompt
+prompt: |
+  Review usage/activity data (from {{analytics_hint}} or the database) for
+  paying accounts.
+  1. Compare each account's activity in the last {{recent_days}} days to
+     their prior baseline.
+  2. Flag accounts with a drop of {{drop_threshold_pct}}% or more as churn
+     risks.
+  3. Report the flagged accounts ranked by drop size, with their plan
+     value, so outreach can be prioritized.
+variables:
+  analytics_hint:
+    default: "product analytics tool (e.g. Mixpanel, PostHog, Amplitude)"
+    description: Where usage/activity data lives.
+  recent_days:
+    default: 14
+    description: Recent window to compare against baseline.
+  drop_threshold_pct:
+    default: 50
+    description: Percent drop in activity that counts as churn risk.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: No generic script mode — "baseline vs. recent activity" needs querying an analytics source and judgment on what counts as a meaningful drop.

package/jobs/growth/trial-expiring-nudge.yaml

@@ -0,0 +1,33 @@
+id: trial-expiring-nudge
+version: 1
+name: Trial Expiring Nudge
+description: >
+  Finds trial users about to expire who haven't upgraded yet, and can
+  draft the nudge email. Use this if trial-to-paid conversion nudges only
+  happen when someone remembers to send them.
+category: growth
+tags: [growth, trials, conversion]
+schedule: "0 10 * * *"
+timezone: "UTC"
+runner: hybrid
+command: >
+  psql "{{database_url}}" -t -c "select email, trial_ends_at from users where trial_ends_at between now() and now() + interval '{{lookahead_days}} days' and plan = 'trial';"
+prompt: |
+  Find users whose trial ends within the next {{lookahead_days}} days and
+  who haven't upgraded to a paid plan (query {{database_url}} or the
+  billing system).
+  1. List each user with their trial end date.
+  2. Draft a short, friendly nudge email for each, mentioning what they'd
+     lose access to and a clear upgrade link. Don't send — draft only.
+script_note: >
+  `command` lists trial-ending users from Postgres with zero tokens.
+  `prompt` also drafts the nudge email per user, which needs an LLM.
+variables:
+  database_url:
+    default: "postgres://user:pass@host:5432/db"
+    description: Connection string for the users/billing database.
+  lookahead_days:
+    default: 3
+    description: How many days ahead to look for trial expirations.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: Script mode assumes a `users` table with `trial_ends_at` and `plan` columns — adjust the query to your schema.

package/jobs/home/car-maintenance-due-reminder.yaml

@@ -0,0 +1,30 @@
+id: car-maintenance-due-reminder
+version: 1
+name: Car Maintenance Due Reminder
+description: >
+  Warns you when a car maintenance task (oil change, registration, etc.)
+  is coming due by date. Use this if you've ever found out your
+  registration expired because a sticker in the mail got ignored.
+category: home
+tags: [home, car, maintenance]
+schedule: "0 9 * * 1"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  today=$(date +%s);
+  due_ts=$(date -d "{{due_date}}" +%s 2>/dev/null || date -jf "%Y-%m-%d" "{{due_date}}" +%s);
+  days_left=$(( (due_ts - today) / 86400 ));
+  if [ "$days_left" -le "{{warn_days}}" ]; then echo "WARNING: {{task_name}} due in $days_left days ({{due_date}})"; exit 1;
+  else echo "OK: {{task_name}} due in $days_left days"; fi
+variables:
+  task_name:
+    default: "oil change"
+    description: Name of the maintenance task to track.
+  due_date:
+    default: "2026-09-01"
+    description: Date the task is due (YYYY-MM-DD).
+  warn_days:
+    default: 7
+    description: Days before due date to start warning.
+compatible_agents: [generic, claude, codex]
+notes: One task per job instance — schedule multiple copies with different task_name/due_date for oil change, registration, inspection, etc.

package/jobs/learning/cert-renewal-reminder.yaml

@@ -0,0 +1,30 @@
+id: cert-renewal-reminder
+version: 1
+name: Professional Certification Renewal Reminder
+description: >
+  Warns you before a professional certification expires or its renewal
+  window opens. Use this if you've ever let a cert lapse and had to retake
+  an exam that a renewal course would've avoided.
+category: learning
+tags: [learning, certification, renewal]
+schedule: "0 9 1 * *"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  today=$(date +%s);
+  expiry_ts=$(date -d "{{expiry_date}}" +%s 2>/dev/null || date -jf "%Y-%m-%d" "{{expiry_date}}" +%s);
+  days_left=$(( (expiry_ts - today) / 86400 ));
+  if [ "$days_left" -le "{{warn_days}}" ]; then echo "WARNING: {{cert_name}} expires in $days_left days ({{expiry_date}})"; exit 1;
+  else echo "OK: {{cert_name}} expires in $days_left days"; fi
+variables:
+  cert_name:
+    default: "your certification"
+    description: Name of the certification to track.
+  expiry_date:
+    default: "2027-01-01"
+    description: Certification expiry date (YYYY-MM-DD).
+  warn_days:
+    default: 60
+    description: Days before expiry to start warning.
+compatible_agents: [generic, claude, codex]
+notes: Manual expiry_date input — update after each renewal cycle.

package/jobs/learning/conference-cfp-deadline-reminder.yaml

@@ -0,0 +1,42 @@
+id: conference-cfp-deadline-reminder
+version: 1
+name: Conference CFP Deadline Reminder
+description: >
+  Warns you before a conference's call-for-papers deadline, and can help
+  draft your talk proposal. Use this if you've ever meant to submit a talk
+  and missed the CFP because you found out a week too late.
+category: learning
+tags: [learning, conference, cfp, career]
+schedule: "0 9 * * 1"
+timezone: "UTC"
+runner: hybrid
+command: >
+  today=$(date +%s);
+  deadline_ts=$(date -d "{{cfp_deadline}}" +%s 2>/dev/null || date -jf "%Y-%m-%d" "{{cfp_deadline}}" +%s);
+  days_left=$(( (deadline_ts - today) / 86400 ));
+  if [ "$days_left" -le "{{warn_days}}" ] && [ "$days_left" -ge 0 ]; then echo "WARNING: {{conference_name}} CFP closes in $days_left days ({{cfp_deadline}})"; exit 1;
+  else echo "OK: {{conference_name}} CFP closes in $days_left days"; fi
+prompt: |
+  The CFP for {{conference_name}} closes on {{cfp_deadline}}. Compute days
+  remaining from today.
+  1. If within {{warn_days}} days, flag it clearly.
+  2. Help draft a talk proposal abstract based on {{topic_hint}} — title,
+     3-sentence abstract, and why it fits this conference's audience.
+script_note: >
+  `command` only checks the deadline and warns. `prompt` also drafts a
+  talk proposal abstract, which needs an LLM.
+variables:
+  conference_name:
+    default: "a conference"
+    description: Name of the conference.
+  cfp_deadline:
+    default: "2026-09-01"
+    description: CFP submission deadline (YYYY-MM-DD).
+  warn_days:
+    default: 14
+    description: Days before deadline to start warning.
+  topic_hint:
+    default: "a project or topic you've been working on"
+    description: What you'd want to talk about, for the draft abstract.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: Manual cfp_deadline input — update per conference you're tracking.

package/jobs/personal/medication-refill-reminder.yaml

@@ -0,0 +1,30 @@
+id: medication-refill-reminder
+version: 1
+name: Medication Refill Reminder
+description: >
+  Reminds you to refill a medication before you run out, based on how many
+  days of supply you have left. Use this if you've ever run out of a
+  prescription over a weekend when the pharmacy's closed.
+category: personal
+tags: [health, medication, reminder]
+schedule: "0 9 * * *"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  today=$(date +%s);
+  runout_ts=$(date -d "{{runout_date}}" +%s 2>/dev/null || date -jf "%Y-%m-%d" "{{runout_date}}" +%s);
+  days_left=$(( (runout_ts - today) / 86400 ));
+  if [ "$days_left" -le "{{warn_days}}" ]; then echo "WARNING: {{medication_name}} runs out in $days_left days — refill now"; exit 1;
+  else echo "OK: {{medication_name}} has $days_left days left"; fi
+variables:
+  medication_name:
+    default: "your medication"
+    description: Name of the medication to track.
+  runout_date:
+    default: "2026-08-01"
+    description: Date the current supply runs out (YYYY-MM-DD).
+  warn_days:
+    default: 5
+    description: Days before running out to start warning.
+compatible_agents: [generic, claude, codex]
+notes: Manual runout_date input — update it each time you fill the prescription.

package/jobs/productivity/calendar-double-booking-check.yaml

@@ -0,0 +1,21 @@
+id: calendar-double-booking-check
+version: 1
+name: Calendar Double-Booking Check
+description: >
+  Checks today's calendar for overlapping meetings and flags them. Use
+  this if you've ever accepted two invites for the same slot and only
+  noticed when both started ringing.
+category: productivity
+tags: [calendar, meetings, productivity]
+schedule: "0 7 * * 1-5"
+timezone: "America/Los_Angeles"
+runner: agent-prompt
+prompt: |
+  Check today's calendar for overlapping events.
+  1. List all meetings scheduled for today.
+  2. Flag any pair of events whose times overlap.
+  3. For each conflict, report both event names, times, and organizers so
+     it's obvious which one to decline or reschedule.
+variables: {}
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: No generic script mode — calendar access is provider-specific (Google Calendar, Outlook, etc.) and typically needs an agent with calendar-tool access.

package/jobs/productivity/stale-todo-sweep.yaml

@@ -0,0 +1,26 @@
+id: stale-todo-sweep
+version: 1
+name: Stale Todo Sweep
+description: >
+  Finds TODO/FIXME comments in your codebase that have sat untouched for a
+  long time, so you can decide whether to fix, ticket, or delete them. Use
+  this if TODO comments in this repo have basically become permanent decor.
+category: productivity
+tags: [todos, cleanup, code-hygiene]
+schedule: "0 9 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  grep -rn "TODO\|FIXME" {{search_dir}} --include="*.{{ext}}" 2>/dev/null | while IFS=: read -r file line rest; do
+    last_change=$(git -C {{search_dir}} log -1 --format=%ar -- "$file" 2>/dev/null);
+    echo "$file:$line last touched $last_change: $rest"
+  done
+variables:
+  search_dir:
+    default: "."
+    description: Directory to search for TODO/FIXME comments.
+  ext:
+    default: "js"
+    description: File extension to search (single extension; run multiple copies for multiple languages).
+compatible_agents: [generic, claude, codex]
+notes: The "last touched" date reflects the file's last git change, not the specific TODO line — a big refactor nearby will reset the age even if the TODO itself is old.

package/jobs/security/cve-watch.yaml

@@ -0,0 +1,27 @@
+id: cve-watch
+version: 1
+name: CVE Watch
+description: >
+  Checks for newly published CVEs affecting packages in your stack. Use
+  this if you want a heads-up on a critical vulnerability before it shows
+  up in a routine dependency audit days later.
+category: security
+tags: [security, cve, vulnerabilities]
+schedule: "0 8 * * *"
+timezone: "UTC"
+runner: agent-prompt
+prompt: |
+  Check for new CVEs published in the last 24 hours affecting the
+  dependencies used in this project (see {{manifest_hint}}).
+  1. Pull the current dependency list (name + version) from the manifest.
+  2. Check a CVE/vulnerability source (NVD, GitHub Advisory Database, OSV)
+     for new entries matching those packages.
+  3. Report any matches with severity, and whether a patched version is
+     already available.
+  4. If nothing new, say so in one line.
+variables:
+  manifest_hint:
+    default: "package.json / requirements.txt / go.mod"
+    description: Which dependency manifest(s) to read for this project.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: No generic script mode — matching CVEs to an arbitrary manifest against a live advisory database needs an agent, not a fixed CLI call.

package/jobs/security/iam-key-rotation-reminder.yaml

@@ -0,0 +1,27 @@
+id: iam-key-rotation-reminder
+version: 1
+name: IAM Key Rotation Reminder
+description: >
+  Checks how old your IAM access keys are and flags any past your rotation
+  age. Use this if you've ever found a years-old access key still active
+  because nobody was tracking key age.
+category: security
+tags: [security, iam, aws, rotation]
+schedule: "0 8 1 * *"
+timezone: "UTC"
+runner: shell
+command: >
+  today=$(date +%s);
+  aws iam list-users --query 'Users[].UserName' --output text | tr '\t' '\n' | while read -r user; do
+    aws iam list-access-keys --user-name "$user" --query 'AccessKeyMetadata[].[AccessKeyId,CreateDate]' --output text | while read -r key created; do
+      created_ts=$(date -d "$created" +%s 2>/dev/null || date -jf "%Y-%m-%dT%H:%M:%S" "${created%+*}" +%s 2>/dev/null);
+      age_days=$(( (today - created_ts) / 86400 ));
+      if [ "$age_days" -ge "{{max_age_days}}" ]; then echo "WARNING: key $key for user $user is $age_days days old"; fi;
+    done;
+  done
+variables:
+  max_age_days:
+    default: 90
+    description: Key age in days before it's flagged for rotation.
+compatible_agents: [generic, claude, codex]
+notes: Requires AWS CLI with iam:ListUsers and iam:ListAccessKeys permissions.

package/jobs/security/s3-public-bucket-check.yaml

@@ -0,0 +1,20 @@
+id: s3-public-bucket-check
+version: 1
+name: S3 Public Bucket Check
+description: >
+  Checks your S3 buckets for public access and flags any that are exposed.
+  Use this if a misconfigured bucket policy has ever quietly made private
+  data public.
+category: security
+tags: [security, s3, aws, exposure]
+schedule: "0 6 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  aws s3api list-buckets --query 'Buckets[].Name' --output text | tr '\t' '\n' | while read -r bucket; do
+    status=$(aws s3api get-public-access-block --bucket "$bucket" 2>/dev/null);
+    if [ -z "$status" ]; then echo "WARNING: $bucket has no public access block configured"; fi;
+  done
+variables: {}
+compatible_agents: [generic, claude, codex]
+notes: Requires AWS CLI configured with credentials that can call s3api list-buckets and get-public-access-block.

package/jobs/team/oncall-handoff-reminder.yaml

@@ -0,0 +1,26 @@
+id: oncall-handoff-reminder
+version: 1
+name: On-call Handoff Reminder
+description: >
+  Nudges outgoing and incoming on-call to sync before the shift changes.
+  Use this if a handoff has ever happened silently and the new on-call
+  found out about an open incident from a page instead of a briefing.
+category: team
+tags: [oncall, handoff, team]
+schedule: "0 9 * * 1"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  echo "On-call handoff today: {{outgoing}} -> {{incoming}}. Sync on open incidents, recent alerts, and anything in-flight before {{handoff_time}}."
+variables:
+  outgoing:
+    default: "outgoing on-call"
+    description: Name of the person finishing their on-call shift.
+  incoming:
+    default: "incoming on-call"
+    description: Name of the person starting their on-call shift.
+  handoff_time:
+    default: "10:00"
+    description: Time the handoff should be complete by.
+compatible_agents: [generic, claude, codex]
+notes: Static reminder text — plug in your actual rotation (e.g. pull outgoing/incoming from PagerDuty) if you want it dynamic.

package/jobs/team/team-anniversary-reminder.yaml

@@ -0,0 +1,22 @@
+id: team-anniversary-reminder
+version: 1
+name: Team Anniversary Reminder
+description: >
+  Reminds you about teammates' birthdays and work anniversaries coming up
+  this week. Use this if you've ever felt bad realizing a work anniversary
+  passed with zero acknowledgment.
+category: team
+tags: [team, birthdays, anniversaries]
+schedule: "0 9 * * 1"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  today=$(date +%m-%d);
+  end=$(date -d "+7 days" +%m-%d 2>/dev/null || date -v+7d +%m-%d);
+  awk -F, -v today="$today" -v end="$end" '$2 >= today && $2 <= end {print "UPCOMING: " $1 " (" $3 ") on " $2}' {{roster_csv}}
+variables:
+  roster_csv:
+    default: "team-dates.csv"
+    description: "CSV with columns: name,date(MM-DD),type(birthday/anniversary)."
+compatible_agents: [generic, claude, codex]
+notes: Simple string comparison on MM-DD, so it doesn't handle windows spanning year-end (Dec into Jan) correctly — fine for most weeks.

package/jobs/travel/frequent-flyer-miles-expiry.yaml

@@ -0,0 +1,30 @@
+id: frequent-flyer-miles-expiry
+version: 1
+name: Frequent Flyer Miles Expiry Check
+description: >
+  Warns you before frequent flyer miles or points expire from inactivity.
+  Use this if you've ever lost a stash of miles just because you didn't
+  fly or transact on the account in time.
+category: travel
+tags: [travel, miles, points, loyalty]
+schedule: "0 9 1 * *"
+timezone: "UTC"
+runner: shell
+command: >
+  today=$(date +%s);
+  expiry_ts=$(date -d "{{expiry_date}}" +%s 2>/dev/null || date -jf "%Y-%m-%d" "{{expiry_date}}" +%s);
+  days_left=$(( (expiry_ts - today) / 86400 ));
+  if [ "$days_left" -le "{{warn_days}}" ]; then echo "WARNING: {{program_name}} miles expire in $days_left days ({{expiry_date}})"; exit 1;
+  else echo "OK: {{program_name}} miles expire in $days_left days"; fi
+variables:
+  program_name:
+    default: "your airline program"
+    description: Name of the loyalty program.
+  expiry_date:
+    default: "2027-01-01"
+    description: Date the miles/points are set to expire (YYYY-MM-DD).
+  warn_days:
+    default: 30
+    description: Days before expiry to start warning.
+compatible_agents: [generic, claude, codex]
+notes: Expiry date is a manual input since most loyalty programs don't expose it via a public API — update expiry_date after checking your account.