@wonsukchoi/crondex 0.5.0 → 0.7.0

package/jobs/sales/stale-deal-nudge.yaml

@@ -0,0 +1,35 @@
+id: stale-deal-nudge
+version: 1
+name: Stale Deal Nudge
+description: >
+  Finds open pipeline deals nobody's touched in a while. Use this if deals
+  have ever quietly died in "in progress" because follow-up only happens
+  when someone remembers.
+category: sales
+tags: [sales, pipeline, crm]
+schedule: "0 8 * * 1-5"
+timezone: "UTC"
+runner: hybrid
+command: >
+  psql "{{database_url}}" -t -c "select name, owner, last_activity_at from deals where stage not in ('closed_won','closed_lost') and last_activity_at < now() - interval '{{stale_days}} days';"
+prompt: |
+  Find open deals in {{crm_hint}} with no activity in the last
+  {{stale_days}} days.
+  1. List each deal with owner, stage, value, and days since last activity.
+  2. Draft a short follow-up nudge message for the owner of each, prompting
+     next-step action (call, email, or mark as closed-lost).
+script_note: >
+  `command` lists stale deals from Postgres with zero tokens. `prompt`
+  works with any CRM and also drafts the follow-up nudge per owner.
+variables:
+  database_url:
+    default: "postgres://user:pass@host:5432/db"
+    description: Connection string for the CRM/deals database.
+  crm_hint:
+    default: "your CRM (Salesforce, HubSpot, Pipedrive)"
+    description: Name of the CRM in use, for agent-prompt mode.
+  stale_days:
+    default: 14
+    description: Days without activity before a deal counts as stale.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: Script mode assumes a `deals` table with `stage`, `owner`, and `last_activity_at` columns — adjust the query to your schema.

package/jobs/security/2fa-enrollment-audit.yaml

@@ -0,0 +1,24 @@
+id: 2fa-enrollment-audit
+version: 1
+name: 2FA Enrollment Audit
+description: >
+  Checks which team members in your identity provider or GitHub org don't
+  have two-factor auth enabled. Use this if you've ever assumed everyone
+  had 2FA on until an incident review proved otherwise.
+category: security
+tags: [security, 2fa, access]
+schedule: "0 9 1 * *"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v gh >/dev/null 2>&1 || { echo "ERROR: gh CLI not installed"; exit 1; };
+  gh api "orgs/{{org}}/members?filter=2fa_disabled" --jq '.[].login' > /tmp/2fa-disabled.txt 2>/dev/null;
+  count=$(wc -l < /tmp/2fa-disabled.txt | tr -d ' ');
+  if [ "$count" -eq 0 ]; then echo "OK: all org members have 2FA enabled";
+  else echo "WARNING: $count member(s) without 2FA:"; cat /tmp/2fa-disabled.txt; fi
+variables:
+  org:
+    default: "your-org"
+    description: GitHub organization login to audit.
+compatible_agents: [generic, claude, codex]
+notes: Requires gh CLI authenticated as an org owner/admin — the 2fa_disabled filter needs admin:org scope.

package/jobs/security/cve-watch.yaml

@@ -0,0 +1,27 @@
+id: cve-watch
+version: 1
+name: CVE Watch
+description: >
+  Checks for newly published CVEs affecting packages in your stack. Use
+  this if you want a heads-up on a critical vulnerability before it shows
+  up in a routine dependency audit days later.
+category: security
+tags: [security, cve, vulnerabilities]
+schedule: "0 8 * * *"
+timezone: "UTC"
+runner: agent-prompt
+prompt: |
+  Check for new CVEs published in the last 24 hours affecting the
+  dependencies used in this project (see {{manifest_hint}}).
+  1. Pull the current dependency list (name + version) from the manifest.
+  2. Check a CVE/vulnerability source (NVD, GitHub Advisory Database, OSV)
+     for new entries matching those packages.
+  3. Report any matches with severity, and whether a patched version is
+     already available.
+  4. If nothing new, say so in one line.
+variables:
+  manifest_hint:
+    default: "package.json / requirements.txt / go.mod"
+    description: Which dependency manifest(s) to read for this project.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: No generic script mode — matching CVEs to an arbitrary manifest against a live advisory database needs an agent, not a fixed CLI call.

package/jobs/security/dependabot-alert-digest.yaml

@@ -0,0 +1,30 @@
+id: dependabot-alert-digest
+version: 1
+name: Dependabot Alert Digest
+description: >
+  Rolls up open Dependabot security alerts across a repo into one digest.
+  Use this if Dependabot alerts have ever piled up in a tab nobody checks
+  instead of getting triaged as they come in.
+category: security
+tags: [security, dependabot, github]
+schedule: "0 8 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v gh >/dev/null 2>&1 || { echo "ERROR: gh CLI not installed"; exit 1; };
+  count=$(gh api "repos/{{owner}}/{{repo}}/dependabot/alerts?state=open" --jq 'length' 2>/dev/null);
+  if [ -z "$count" ]; then echo "ERROR: could not fetch Dependabot alerts (check gh auth and repo access)"; exit 1;
+  elif [ "$count" -eq 0 ]; then echo "OK: no open Dependabot alerts";
+  else
+    echo "$count open Dependabot alert(s):";
+    gh api "repos/{{owner}}/{{repo}}/dependabot/alerts?state=open" --jq '.[] | "- " + .security_advisory.severity + ": " + .security_advisory.summary';
+  fi
+variables:
+  owner:
+    default: "your-org"
+    description: GitHub repo owner/org.
+  repo:
+    default: "your-repo"
+    description: GitHub repo name.
+compatible_agents: [generic, claude, codex]
+notes: Requires gh CLI authenticated with a token that has security_events read access on the repo.

package/jobs/security/expiring-api-key-rotation.yaml

@@ -0,0 +1,31 @@
+id: expiring-api-key-rotation
+version: 1
+name: Expiring API Key Rotation Reminder
+description: >
+  Warns you before a third-party API key or token you're tracking expires.
+  Use this if an integration has ever gone down in production because a
+  key expired and nobody rotated it in time.
+category: security
+tags: [security, api-keys, rotation]
+schedule: "0 8 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  today=$(date +%s);
+  awk -F, -v today="$today" -v warn={{warn_days}} '
+    NR>1 {
+      cmd="date -d \"" $2 "\" +%s 2>/dev/null || date -jf \"%Y-%m-%d\" \"" $2 "\" +%s";
+      cmd | getline exp_ts; close(cmd);
+      days_left = int((exp_ts - today) / 86400);
+      if (days_left <= warn) print "WARNING: key \"" $1 "\" expires in " days_left " days (" $2 ")";
+    }
+  ' {{keys_csv}}
+variables:
+  keys_csv:
+    default: "api-keys.csv"
+    description: "CSV with header row, columns: key_name,expiry_date(YYYY-MM-DD)."
+  warn_days:
+    default: 14
+    description: Days before expiry to start warning.
+compatible_agents: [generic, claude, codex]
+notes: Keep api-keys.csv updated manually as a lightweight registry — most providers don't expose expiry via a common API.

package/jobs/security/iam-key-rotation-reminder.yaml

@@ -0,0 +1,27 @@
+id: iam-key-rotation-reminder
+version: 1
+name: IAM Key Rotation Reminder
+description: >
+  Checks how old your IAM access keys are and flags any past your rotation
+  age. Use this if you've ever found a years-old access key still active
+  because nobody was tracking key age.
+category: security
+tags: [security, iam, aws, rotation]
+schedule: "0 8 1 * *"
+timezone: "UTC"
+runner: shell
+command: >
+  today=$(date +%s);
+  aws iam list-users --query 'Users[].UserName' --output text | tr '\t' '\n' | while read -r user; do
+    aws iam list-access-keys --user-name "$user" --query 'AccessKeyMetadata[].[AccessKeyId,CreateDate]' --output text | while read -r key created; do
+      created_ts=$(date -d "$created" +%s 2>/dev/null || date -jf "%Y-%m-%dT%H:%M:%S" "${created%+*}" +%s 2>/dev/null);
+      age_days=$(( (today - created_ts) / 86400 ));
+      if [ "$age_days" -ge "{{max_age_days}}" ]; then echo "WARNING: key $key for user $user is $age_days days old"; fi;
+    done;
+  done
+variables:
+  max_age_days:
+    default: 90
+    description: Key age in days before it's flagged for rotation.
+compatible_agents: [generic, claude, codex]
+notes: Requires AWS CLI with iam:ListUsers and iam:ListAccessKeys permissions.

package/jobs/security/s3-public-bucket-check.yaml

@@ -0,0 +1,20 @@
+id: s3-public-bucket-check
+version: 1
+name: S3 Public Bucket Check
+description: >
+  Checks your S3 buckets for public access and flags any that are exposed.
+  Use this if a misconfigured bucket policy has ever quietly made private
+  data public.
+category: security
+tags: [security, s3, aws, exposure]
+schedule: "0 6 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  aws s3api list-buckets --query 'Buckets[].Name' --output text | tr '\t' '\n' | while read -r bucket; do
+    status=$(aws s3api get-public-access-block --bucket "$bucket" 2>/dev/null);
+    if [ -z "$status" ]; then echo "WARNING: $bucket has no public access block configured"; fi;
+  done
+variables: {}
+compatible_agents: [generic, claude, codex]
+notes: Requires AWS CLI configured with credentials that can call s3api list-buckets and get-public-access-block.

package/jobs/security/tls-cipher-weak-check.yaml

@@ -0,0 +1,31 @@
+id: tls-cipher-weak-check
+version: 1
+name: Weak TLS Cipher/Protocol Check
+description: >
+  Checks a host for weak TLS protocol versions or ciphers still enabled.
+  Use this if a legacy protocol has ever stayed enabled for "just in
+  case" long after every client that needed it was gone.
+category: security
+tags: [security, tls, ciphers]
+schedule: "0 6 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v openssl >/dev/null 2>&1 || { echo "ERROR: openssl not installed"; exit 1; };
+  weak_found=0;
+  for proto in ssl3 tls1 tls1_1; do
+    if openssl s_client -connect {{host}}:{{port}} -$proto </dev/null 2>/dev/null | grep -q "Cipher is"; then
+      echo "WARNING: {{host}}:{{port}} accepts $proto";
+      weak_found=1;
+    fi;
+  done;
+  if [ "$weak_found" -eq 0 ]; then echo "OK: {{host}}:{{port}} does not accept SSLv3/TLS1.0/TLS1.1"; else exit 1; fi
+variables:
+  host:
+    default: "example.com"
+    description: Hostname to check.
+  port:
+    default: 443
+    description: Port to check.
+compatible_agents: [generic, claude, codex]
+notes: Requires an openssl build with legacy protocol support compiled in to actually detect them; a modern openssl that's dropped them entirely will just fail to connect either way (still safe).

package/jobs/security/waf-rule-change-watch.yaml

@@ -0,0 +1,38 @@
+id: waf-rule-change-watch
+version: 1
+name: WAF Rule Change Watch
+description: >
+  Diffs your current WAF rules against a saved baseline and flags drift.
+  Use this if a WAF rule has ever been loosened "just for testing" and
+  never put back.
+category: security
+tags: [security, waf, drift]
+schedule: "0 6 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v aws >/dev/null 2>&1 || { echo "ERROR: aws CLI not installed"; exit 1; };
+  aws wafv2 get-web-acl --name {{web_acl_name}} --scope {{scope}} --id {{web_acl_id}} --query 'WebACL.Rules' --output json > /tmp/waf-current.json 2>/dev/null;
+  if [ ! -s /tmp/waf-current.json ]; then echo "ERROR: could not fetch WAF rules for {{web_acl_name}}"; exit 1; fi;
+  if [ -f {{baseline_file}} ]; then
+    if diff -q {{baseline_file}} /tmp/waf-current.json >/dev/null; then echo "OK: WAF rules match baseline";
+    else echo "DRIFT DETECTED in {{web_acl_name}} rules:"; diff {{baseline_file}} /tmp/waf-current.json; exit 1; fi
+  else
+    echo "no baseline at {{baseline_file}} yet — copying current rules as the new baseline";
+    cp /tmp/waf-current.json {{baseline_file}};
+  fi
+variables:
+  web_acl_name:
+    default: "your-web-acl"
+    description: Name of the AWS WAFv2 Web ACL to check.
+  web_acl_id:
+    default: "your-web-acl-id"
+    description: ID of the Web ACL.
+  scope:
+    default: "REGIONAL"
+    description: WAF scope, REGIONAL or CLOUDFRONT.
+  baseline_file:
+    default: "waf-baseline.json"
+    description: Path to the saved baseline rules file to diff against.
+compatible_agents: [generic, claude, codex]
+notes: Written for AWS WAFv2 — adapt the fetch command for Cloudflare, Azure Front Door, or other WAF providers.

package/jobs/support/csat-score-watch.yaml

@@ -0,0 +1,32 @@
+id: csat-score-watch
+version: 1
+name: CSAT Score Watch
+description: >
+  Checks your recent customer satisfaction score and flags it if it drops
+  below your target. Use this if CSAT only gets looked at once a quarter,
+  by which point a bad week is old news.
+category: support
+tags: [support, csat, customer-satisfaction]
+schedule: "0 9 * * 1"
+timezone: "UTC"
+runner: agent-prompt
+prompt: |
+  Check the CSAT (or equivalent satisfaction) score for the last
+  {{lookback_days}} days from {{csat_source_hint}}.
+  1. Compare it to the {{target_score}} target.
+  2. If below target, pull 2-3 representative low-scoring responses to
+     show what's driving it.
+  3. Report the score, trend vs. the prior period, and the drivers if
+     applicable, in under 150 words.
+variables:
+  csat_source_hint:
+    default: "helpdesk tool (Zendesk, Intercom, etc.)"
+    description: Where CSAT/satisfaction survey data lives.
+  lookback_days:
+    default: 7
+    description: Rolling window to evaluate.
+  target_score:
+    default: 90
+    description: Target CSAT score (percent or your tool's native scale).
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: No generic script mode — CSAT scoring and survey formats vary too much by helpdesk tool for a fixed command.

package/jobs/support/ticket-backlog-aging-check.yaml

@@ -0,0 +1,30 @@
+id: ticket-backlog-aging-check
+version: 1
+name: Support Ticket Backlog Aging Check
+description: >
+  Checks how many open support tickets have sat unanswered past your SLA
+  window. Use this if tickets have ever quietly aged past their SLA
+  because the backlog view wasn't checked that day.
+category: support
+tags: [support, sla, tickets]
+schedule: "0 */4 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v curl >/dev/null 2>&1 || { echo "ERROR: curl not installed"; exit 1; };
+  count=$(curl -s -H "Authorization: Bearer {{api_token}}" "{{api_url}}" | grep -o '"status":"open"' | wc -l | tr -d ' ');
+  if [ -z "$count" ] || [ "$count" -eq 0 ]; then echo "OK: no aging open tickets found (or endpoint returned nothing)"; exit 0;
+  elif [ "$count" -ge "{{threshold}}" ]; then echo "WARNING: $count open tickets past SLA at {{api_url}}"; exit 1;
+  else echo "OK: $count open tickets past SLA (under threshold {{threshold}})"; fi
+variables:
+  api_url:
+    default: "https://api.example-helpdesk.com/tickets?status=open&age_gt_hours=24"
+    description: Helpdesk API endpoint pre-filtered to tickets past your SLA age.
+  api_token:
+    default: "your-api-token"
+    description: Bearer token for the helpdesk API.
+  threshold:
+    default: 5
+    description: Number of aging open tickets that triggers a warning.
+compatible_agents: [generic, claude, codex]
+notes: Generic REST pattern — point api_url at your helpdesk's (Zendesk, Intercom, Freshdesk) filtered ticket search endpoint; adjust the grep pattern to match its response shape.

package/jobs/team/oncall-handoff-reminder.yaml

@@ -0,0 +1,26 @@
+id: oncall-handoff-reminder
+version: 1
+name: On-call Handoff Reminder
+description: >
+  Nudges outgoing and incoming on-call to sync before the shift changes.
+  Use this if a handoff has ever happened silently and the new on-call
+  found out about an open incident from a page instead of a briefing.
+category: team
+tags: [oncall, handoff, team]
+schedule: "0 9 * * 1"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  echo "On-call handoff today: {{outgoing}} -> {{incoming}}. Sync on open incidents, recent alerts, and anything in-flight before {{handoff_time}}."
+variables:
+  outgoing:
+    default: "outgoing on-call"
+    description: Name of the person finishing their on-call shift.
+  incoming:
+    default: "incoming on-call"
+    description: Name of the person starting their on-call shift.
+  handoff_time:
+    default: "10:00"
+    description: Time the handoff should be complete by.
+compatible_agents: [generic, claude, codex]
+notes: Static reminder text — plug in your actual rotation (e.g. pull outgoing/incoming from PagerDuty) if you want it dynamic.

package/jobs/team/team-anniversary-reminder.yaml

@@ -0,0 +1,22 @@
+id: team-anniversary-reminder
+version: 1
+name: Team Anniversary Reminder
+description: >
+  Reminds you about teammates' birthdays and work anniversaries coming up
+  this week. Use this if you've ever felt bad realizing a work anniversary
+  passed with zero acknowledgment.
+category: team
+tags: [team, birthdays, anniversaries]
+schedule: "0 9 * * 1"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  today=$(date +%m-%d);
+  end=$(date -d "+7 days" +%m-%d 2>/dev/null || date -v+7d +%m-%d);
+  awk -F, -v today="$today" -v end="$end" '$2 >= today && $2 <= end {print "UPCOMING: " $1 " (" $3 ") on " $2}' {{roster_csv}}
+variables:
+  roster_csv:
+    default: "team-dates.csv"
+    description: "CSV with columns: name,date(MM-DD),type(birthday/anniversary)."
+compatible_agents: [generic, claude, codex]
+notes: Simple string comparison on MM-DD, so it doesn't handle windows spanning year-end (Dec into Jan) correctly — fine for most weeks.

package/jobs/travel/frequent-flyer-miles-expiry.yaml

@@ -0,0 +1,30 @@
+id: frequent-flyer-miles-expiry
+version: 1
+name: Frequent Flyer Miles Expiry Check
+description: >
+  Warns you before frequent flyer miles or points expire from inactivity.
+  Use this if you've ever lost a stash of miles just because you didn't
+  fly or transact on the account in time.
+category: travel
+tags: [travel, miles, points, loyalty]
+schedule: "0 9 1 * *"
+timezone: "UTC"
+runner: shell
+command: >
+  today=$(date +%s);
+  expiry_ts=$(date -d "{{expiry_date}}" +%s 2>/dev/null || date -jf "%Y-%m-%d" "{{expiry_date}}" +%s);
+  days_left=$(( (expiry_ts - today) / 86400 ));
+  if [ "$days_left" -le "{{warn_days}}" ]; then echo "WARNING: {{program_name}} miles expire in $days_left days ({{expiry_date}})"; exit 1;
+  else echo "OK: {{program_name}} miles expire in $days_left days"; fi
+variables:
+  program_name:
+    default: "your airline program"
+    description: Name of the loyalty program.
+  expiry_date:
+    default: "2027-01-01"
+    description: Date the miles/points are set to expire (YYYY-MM-DD).
+  warn_days:
+    default: 30
+    description: Days before expiry to start warning.
+compatible_agents: [generic, claude, codex]
+notes: Expiry date is a manual input since most loyalty programs don't expose it via a public API — update expiry_date after checking your account.

package/jobs/travel/travel-insurance-expiry-check.yaml

@@ -0,0 +1,26 @@
+id: travel-insurance-expiry-check
+version: 1
+name: Travel Insurance Expiry Check
+description: >
+  Warns you if you have an upcoming trip with no travel insurance policy
+  covering it, or a policy expiring before the trip ends. Use this if
+  you've ever booked a trip and only thought about insurance the night before.
+category: travel
+tags: [travel, insurance, documents]
+schedule: "0 9 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  policy_end_ts=$(date -d "{{policy_end_date}}" +%s 2>/dev/null || date -jf "%Y-%m-%d" "{{policy_end_date}}" +%s);
+  trip_end_ts=$(date -d "{{trip_end_date}}" +%s 2>/dev/null || date -jf "%Y-%m-%d" "{{trip_end_date}}" +%s);
+  if [ "$policy_end_ts" -lt "$trip_end_ts" ]; then echo "WARNING: travel insurance ends {{policy_end_date}}, before trip ends {{trip_end_date}}"; exit 1;
+  else echo "OK: travel insurance covers the full trip"; fi
+variables:
+  policy_end_date:
+    default: "2026-12-31"
+    description: Date your current travel insurance policy ends (YYYY-MM-DD).
+  trip_end_date:
+    default: "2026-12-31"
+    description: Date your upcoming trip ends (YYYY-MM-DD).
+compatible_agents: [generic, claude, codex]
+notes: Manual date inputs — update policy_end_date and trip_end_date per trip since there's no standard API for insurance policies.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wonsukchoi/crondex",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "A public directory of pre-made, agent-editable cron jobs.",
   "type": "module",
   "license": "MIT",