@wonsukchoi/crondex 0.6.0 → 0.7.0

package/jobs/productivity/timezone-meeting-conflict-check.yaml

@@ -0,0 +1,31 @@
+id: timezone-meeting-conflict-check
+version: 1
+name: Timezone Meeting Conflict Check
+description: >
+  Checks tomorrow's meetings against a remote teammate's working hours and
+  flags any that fall outside them. Use this if a meeting has ever gotten
+  scheduled at 11pm for someone across the world without anyone realizing.
+category: productivity
+tags: [calendar, timezone, meetings]
+schedule: "0 16 * * *"
+timezone: "America/Los_Angeles"
+runner: agent-prompt
+prompt: |
+  Check tomorrow's calendar for meetings that include {{teammate_name}}
+  (timezone {{teammate_timezone}}, working hours {{working_hours}}).
+  1. Convert each meeting time to {{teammate_name}}'s local time.
+  2. Flag any meeting that falls outside their stated working hours.
+  3. Suggest an alternative time inside working hours for each flagged
+     meeting if the calendar shows open slots.
+variables:
+  teammate_name:
+    default: "your remote teammate"
+    description: Name of the teammate to check meetings against.
+  teammate_timezone:
+    default: "Europe/Berlin"
+    description: IANA timezone for the teammate.
+  working_hours:
+    default: "09:00-18:00"
+    description: The teammate's normal working hours, local time.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: No generic script mode — calendar access and timezone-aware conflict detection need an agent with calendar-tool access.

package/jobs/realestate/lease-expiry-reminder.yaml

@@ -0,0 +1,30 @@
+id: lease-expiry-reminder
+version: 1
+name: Lease Expiry Reminder
+description: >
+  Warns you before a lease ends so there's time to renew, renegotiate, or
+  start looking. Use this if a lease has ever gone month-to-month, or
+  ended, without anyone noticing the date was coming.
+category: realestate
+tags: [realestate, lease, reminder]
+schedule: "0 9 1 * *"
+timezone: "UTC"
+runner: shell
+command: >
+  today=$(date +%s);
+  end_ts=$(date -d "{{lease_end_date}}" +%s 2>/dev/null || date -jf "%Y-%m-%d" "{{lease_end_date}}" +%s);
+  days_left=$(( (end_ts - today) / 86400 ));
+  if [ "$days_left" -le "{{warn_days}}" ]; then echo "WARNING: lease for {{property_name}} ends in $days_left days ({{lease_end_date}})"; exit 1;
+  else echo "OK: lease for {{property_name}} ends in $days_left days"; fi
+variables:
+  property_name:
+    default: "your unit"
+    description: Name/address of the leased property.
+  lease_end_date:
+    default: "2027-01-01"
+    description: Lease end date (YYYY-MM-DD).
+  warn_days:
+    default: 60
+    description: Days before end date to start warning.
+compatible_agents: [generic, claude, codex]
+notes: Manual lease_end_date input — run one copy per property/unit you're tracking.

package/jobs/realestate/rental-vacancy-check.yaml

@@ -0,0 +1,30 @@
+id: rental-vacancy-check
+version: 1
+name: Rental Vacancy Check
+description: >
+  Flags a rental listing that's been vacant longer than expected. Use this
+  if a unit has ever sat empty for months while everyone assumed someone
+  else was handling the listing.
+category: realestate
+tags: [realestate, vacancy, listings]
+schedule: "0 9 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  today=$(date +%s);
+  vacant_since_ts=$(date -d "{{vacant_since_date}}" +%s 2>/dev/null || date -jf "%Y-%m-%d" "{{vacant_since_date}}" +%s);
+  days_vacant=$(( (today - vacant_since_ts) / 86400 ));
+  if [ "$days_vacant" -ge "{{warn_days}}" ]; then echo "WARNING: {{property_name}} has been vacant $days_vacant days (since {{vacant_since_date}})"; exit 1;
+  else echo "OK: {{property_name}} vacant $days_vacant days"; fi
+variables:
+  property_name:
+    default: "your unit"
+    description: Name/address of the vacant property.
+  vacant_since_date:
+    default: "2026-06-01"
+    description: Date the unit became vacant (YYYY-MM-DD).
+  warn_days:
+    default: 30
+    description: Days vacant before it's flagged.
+compatible_agents: [generic, claude, codex]
+notes: Manual vacant_since_date input — update it once the unit is leased, or when a new vacancy starts.

package/jobs/sales/lead-response-time-check.yaml

@@ -0,0 +1,23 @@
+id: lead-response-time-check
+version: 1
+name: Lead Response Time Check
+description: >
+  Flags new inbound leads that haven't gotten a first response within your
+  target window. Use this if you've ever lost a hot lead simply because
+  nobody replied fast enough.
+category: sales
+tags: [sales, leads, response-time]
+schedule: "*/30 * * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  psql "{{database_url}}" -t -c "select name, email, created_at from leads where first_response_at is null and created_at < now() - interval '{{max_response_minutes}} minutes';"
+variables:
+  database_url:
+    default: "postgres://user:pass@host:5432/db"
+    description: Connection string for the leads database.
+  max_response_minutes:
+    default: 30
+    description: Minutes a lead can go without a first response before it's flagged.
+compatible_agents: [generic, claude, codex]
+notes: Assumes a `leads` table with `created_at` and `first_response_at` columns — adjust the query to your CRM's schema.

package/jobs/sales/stale-deal-nudge.yaml

@@ -0,0 +1,35 @@
+id: stale-deal-nudge
+version: 1
+name: Stale Deal Nudge
+description: >
+  Finds open pipeline deals nobody's touched in a while. Use this if deals
+  have ever quietly died in "in progress" because follow-up only happens
+  when someone remembers.
+category: sales
+tags: [sales, pipeline, crm]
+schedule: "0 8 * * 1-5"
+timezone: "UTC"
+runner: hybrid
+command: >
+  psql "{{database_url}}" -t -c "select name, owner, last_activity_at from deals where stage not in ('closed_won','closed_lost') and last_activity_at < now() - interval '{{stale_days}} days';"
+prompt: |
+  Find open deals in {{crm_hint}} with no activity in the last
+  {{stale_days}} days.
+  1. List each deal with owner, stage, value, and days since last activity.
+  2. Draft a short follow-up nudge message for the owner of each, prompting
+     next-step action (call, email, or mark as closed-lost).
+script_note: >
+  `command` lists stale deals from Postgres with zero tokens. `prompt`
+  works with any CRM and also drafts the follow-up nudge per owner.
+variables:
+  database_url:
+    default: "postgres://user:pass@host:5432/db"
+    description: Connection string for the CRM/deals database.
+  crm_hint:
+    default: "your CRM (Salesforce, HubSpot, Pipedrive)"
+    description: Name of the CRM in use, for agent-prompt mode.
+  stale_days:
+    default: 14
+    description: Days without activity before a deal counts as stale.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: Script mode assumes a `deals` table with `stage`, `owner`, and `last_activity_at` columns — adjust the query to your schema.

package/jobs/security/2fa-enrollment-audit.yaml

@@ -0,0 +1,24 @@
+id: 2fa-enrollment-audit
+version: 1
+name: 2FA Enrollment Audit
+description: >
+  Checks which team members in your identity provider or GitHub org don't
+  have two-factor auth enabled. Use this if you've ever assumed everyone
+  had 2FA on until an incident review proved otherwise.
+category: security
+tags: [security, 2fa, access]
+schedule: "0 9 1 * *"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v gh >/dev/null 2>&1 || { echo "ERROR: gh CLI not installed"; exit 1; };
+  gh api "orgs/{{org}}/members?filter=2fa_disabled" --jq '.[].login' > /tmp/2fa-disabled.txt 2>/dev/null;
+  count=$(wc -l < /tmp/2fa-disabled.txt | tr -d ' ');
+  if [ "$count" -eq 0 ]; then echo "OK: all org members have 2FA enabled";
+  else echo "WARNING: $count member(s) without 2FA:"; cat /tmp/2fa-disabled.txt; fi
+variables:
+  org:
+    default: "your-org"
+    description: GitHub organization login to audit.
+compatible_agents: [generic, claude, codex]
+notes: Requires gh CLI authenticated as an org owner/admin — the 2fa_disabled filter needs admin:org scope.

package/jobs/security/dependabot-alert-digest.yaml

@@ -0,0 +1,30 @@
+id: dependabot-alert-digest
+version: 1
+name: Dependabot Alert Digest
+description: >
+  Rolls up open Dependabot security alerts across a repo into one digest.
+  Use this if Dependabot alerts have ever piled up in a tab nobody checks
+  instead of getting triaged as they come in.
+category: security
+tags: [security, dependabot, github]
+schedule: "0 8 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v gh >/dev/null 2>&1 || { echo "ERROR: gh CLI not installed"; exit 1; };
+  count=$(gh api "repos/{{owner}}/{{repo}}/dependabot/alerts?state=open" --jq 'length' 2>/dev/null);
+  if [ -z "$count" ]; then echo "ERROR: could not fetch Dependabot alerts (check gh auth and repo access)"; exit 1;
+  elif [ "$count" -eq 0 ]; then echo "OK: no open Dependabot alerts";
+  else
+    echo "$count open Dependabot alert(s):";
+    gh api "repos/{{owner}}/{{repo}}/dependabot/alerts?state=open" --jq '.[] | "- " + .security_advisory.severity + ": " + .security_advisory.summary';
+  fi
+variables:
+  owner:
+    default: "your-org"
+    description: GitHub repo owner/org.
+  repo:
+    default: "your-repo"
+    description: GitHub repo name.
+compatible_agents: [generic, claude, codex]
+notes: Requires gh CLI authenticated with a token that has security_events read access on the repo.

package/jobs/security/expiring-api-key-rotation.yaml

@@ -0,0 +1,31 @@
+id: expiring-api-key-rotation
+version: 1
+name: Expiring API Key Rotation Reminder
+description: >
+  Warns you before a third-party API key or token you're tracking expires.
+  Use this if an integration has ever gone down in production because a
+  key expired and nobody rotated it in time.
+category: security
+tags: [security, api-keys, rotation]
+schedule: "0 8 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  today=$(date +%s);
+  awk -F, -v today="$today" -v warn={{warn_days}} '
+    NR>1 {
+      cmd="date -d \"" $2 "\" +%s 2>/dev/null || date -jf \"%Y-%m-%d\" \"" $2 "\" +%s";
+      cmd | getline exp_ts; close(cmd);
+      days_left = int((exp_ts - today) / 86400);
+      if (days_left <= warn) print "WARNING: key \"" $1 "\" expires in " days_left " days (" $2 ")";
+    }
+  ' {{keys_csv}}
+variables:
+  keys_csv:
+    default: "api-keys.csv"
+    description: "CSV with header row, columns: key_name,expiry_date(YYYY-MM-DD)."
+  warn_days:
+    default: 14
+    description: Days before expiry to start warning.
+compatible_agents: [generic, claude, codex]
+notes: Keep api-keys.csv updated manually as a lightweight registry — most providers don't expose expiry via a common API.

package/jobs/security/tls-cipher-weak-check.yaml

@@ -0,0 +1,31 @@
+id: tls-cipher-weak-check
+version: 1
+name: Weak TLS Cipher/Protocol Check
+description: >
+  Checks a host for weak TLS protocol versions or ciphers still enabled.
+  Use this if a legacy protocol has ever stayed enabled for "just in
+  case" long after every client that needed it was gone.
+category: security
+tags: [security, tls, ciphers]
+schedule: "0 6 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v openssl >/dev/null 2>&1 || { echo "ERROR: openssl not installed"; exit 1; };
+  weak_found=0;
+  for proto in ssl3 tls1 tls1_1; do
+    if openssl s_client -connect {{host}}:{{port}} -$proto </dev/null 2>/dev/null | grep -q "Cipher is"; then
+      echo "WARNING: {{host}}:{{port}} accepts $proto";
+      weak_found=1;
+    fi;
+  done;
+  if [ "$weak_found" -eq 0 ]; then echo "OK: {{host}}:{{port}} does not accept SSLv3/TLS1.0/TLS1.1"; else exit 1; fi
+variables:
+  host:
+    default: "example.com"
+    description: Hostname to check.
+  port:
+    default: 443
+    description: Port to check.
+compatible_agents: [generic, claude, codex]
+notes: Requires an openssl build with legacy protocol support compiled in to actually detect them; a modern openssl that's dropped them entirely will just fail to connect either way (still safe).

package/jobs/security/waf-rule-change-watch.yaml

@@ -0,0 +1,38 @@
+id: waf-rule-change-watch
+version: 1
+name: WAF Rule Change Watch
+description: >
+  Diffs your current WAF rules against a saved baseline and flags drift.
+  Use this if a WAF rule has ever been loosened "just for testing" and
+  never put back.
+category: security
+tags: [security, waf, drift]
+schedule: "0 6 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v aws >/dev/null 2>&1 || { echo "ERROR: aws CLI not installed"; exit 1; };
+  aws wafv2 get-web-acl --name {{web_acl_name}} --scope {{scope}} --id {{web_acl_id}} --query 'WebACL.Rules' --output json > /tmp/waf-current.json 2>/dev/null;
+  if [ ! -s /tmp/waf-current.json ]; then echo "ERROR: could not fetch WAF rules for {{web_acl_name}}"; exit 1; fi;
+  if [ -f {{baseline_file}} ]; then
+    if diff -q {{baseline_file}} /tmp/waf-current.json >/dev/null; then echo "OK: WAF rules match baseline";
+    else echo "DRIFT DETECTED in {{web_acl_name}} rules:"; diff {{baseline_file}} /tmp/waf-current.json; exit 1; fi
+  else
+    echo "no baseline at {{baseline_file}} yet — copying current rules as the new baseline";
+    cp /tmp/waf-current.json {{baseline_file}};
+  fi
+variables:
+  web_acl_name:
+    default: "your-web-acl"
+    description: Name of the AWS WAFv2 Web ACL to check.
+  web_acl_id:
+    default: "your-web-acl-id"
+    description: ID of the Web ACL.
+  scope:
+    default: "REGIONAL"
+    description: WAF scope, REGIONAL or CLOUDFRONT.
+  baseline_file:
+    default: "waf-baseline.json"
+    description: Path to the saved baseline rules file to diff against.
+compatible_agents: [generic, claude, codex]
+notes: Written for AWS WAFv2 — adapt the fetch command for Cloudflare, Azure Front Door, or other WAF providers.

package/jobs/support/csat-score-watch.yaml

@@ -0,0 +1,32 @@
+id: csat-score-watch
+version: 1
+name: CSAT Score Watch
+description: >
+  Checks your recent customer satisfaction score and flags it if it drops
+  below your target. Use this if CSAT only gets looked at once a quarter,
+  by which point a bad week is old news.
+category: support
+tags: [support, csat, customer-satisfaction]
+schedule: "0 9 * * 1"
+timezone: "UTC"
+runner: agent-prompt
+prompt: |
+  Check the CSAT (or equivalent satisfaction) score for the last
+  {{lookback_days}} days from {{csat_source_hint}}.
+  1. Compare it to the {{target_score}} target.
+  2. If below target, pull 2-3 representative low-scoring responses to
+     show what's driving it.
+  3. Report the score, trend vs. the prior period, and the drivers if
+     applicable, in under 150 words.
+variables:
+  csat_source_hint:
+    default: "helpdesk tool (Zendesk, Intercom, etc.)"
+    description: Where CSAT/satisfaction survey data lives.
+  lookback_days:
+    default: 7
+    description: Rolling window to evaluate.
+  target_score:
+    default: 90
+    description: Target CSAT score (percent or your tool's native scale).
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: No generic script mode — CSAT scoring and survey formats vary too much by helpdesk tool for a fixed command.

package/jobs/support/ticket-backlog-aging-check.yaml

@@ -0,0 +1,30 @@
+id: ticket-backlog-aging-check
+version: 1
+name: Support Ticket Backlog Aging Check
+description: >
+  Checks how many open support tickets have sat unanswered past your SLA
+  window. Use this if tickets have ever quietly aged past their SLA
+  because the backlog view wasn't checked that day.
+category: support
+tags: [support, sla, tickets]
+schedule: "0 */4 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v curl >/dev/null 2>&1 || { echo "ERROR: curl not installed"; exit 1; };
+  count=$(curl -s -H "Authorization: Bearer {{api_token}}" "{{api_url}}" | grep -o '"status":"open"' | wc -l | tr -d ' ');
+  if [ -z "$count" ] || [ "$count" -eq 0 ]; then echo "OK: no aging open tickets found (or endpoint returned nothing)"; exit 0;
+  elif [ "$count" -ge "{{threshold}}" ]; then echo "WARNING: $count open tickets past SLA at {{api_url}}"; exit 1;
+  else echo "OK: $count open tickets past SLA (under threshold {{threshold}})"; fi
+variables:
+  api_url:
+    default: "https://api.example-helpdesk.com/tickets?status=open&age_gt_hours=24"
+    description: Helpdesk API endpoint pre-filtered to tickets past your SLA age.
+  api_token:
+    default: "your-api-token"
+    description: Bearer token for the helpdesk API.
+  threshold:
+    default: 5
+    description: Number of aging open tickets that triggers a warning.
+compatible_agents: [generic, claude, codex]
+notes: Generic REST pattern — point api_url at your helpdesk's (Zendesk, Intercom, Freshdesk) filtered ticket search endpoint; adjust the grep pattern to match its response shape.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wonsukchoi/crondex",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "A public directory of pre-made, agent-editable cron jobs.",
   "type": "module",
   "license": "MIT",