@wonsukchoi/crondex 0.6.0 → 0.8.0

package/jobs/sales/stale-deal-nudge.yaml

@@ -0,0 +1,35 @@
+id: stale-deal-nudge
+version: 1
+name: Stale Deal Nudge
+description: >
+  Finds open pipeline deals nobody's touched in a while. Use this if deals
+  have ever quietly died in "in progress" because follow-up only happens
+  when someone remembers.
+category: sales
+tags: [sales, pipeline, crm]
+schedule: "0 8 * * 1-5"
+timezone: "UTC"
+runner: hybrid
+command: >
+  psql "{{database_url}}" -t -c "select name, owner, last_activity_at from deals where stage not in ('closed_won','closed_lost') and last_activity_at < now() - interval '{{stale_days}} days';"
+prompt: |
+  Find open deals in {{crm_hint}} with no activity in the last
+  {{stale_days}} days.
+  1. List each deal with owner, stage, value, and days since last activity.
+  2. Draft a short follow-up nudge message for the owner of each, prompting
+     next-step action (call, email, or mark as closed-lost).
+script_note: >
+  `command` lists stale deals from Postgres with zero tokens. `prompt`
+  works with any CRM and also drafts the follow-up nudge per owner.
+variables:
+  database_url:
+    default: "postgres://user:pass@host:5432/db"
+    description: Connection string for the CRM/deals database.
+  crm_hint:
+    default: "your CRM (Salesforce, HubSpot, Pipedrive)"
+    description: Name of the CRM in use, for agent-prompt mode.
+  stale_days:
+    default: 14
+    description: Days without activity before a deal counts as stale.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: Script mode assumes a `deals` table with `stage`, `owner`, and `last_activity_at` columns — adjust the query to your schema.

package/jobs/security/2fa-enrollment-audit.yaml

@@ -0,0 +1,24 @@
+id: 2fa-enrollment-audit
+version: 1
+name: 2FA Enrollment Audit
+description: >
+  Checks which team members in your identity provider or GitHub org don't
+  have two-factor auth enabled. Use this if you've ever assumed everyone
+  had 2FA on until an incident review proved otherwise.
+category: security
+tags: [security, 2fa, access]
+schedule: "0 9 1 * *"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v gh >/dev/null 2>&1 || { echo "ERROR: gh CLI not installed"; exit 1; };
+  gh api "orgs/{{org}}/members?filter=2fa_disabled" --jq '.[].login' > /tmp/2fa-disabled.txt 2>/dev/null;
+  count=$(wc -l < /tmp/2fa-disabled.txt | tr -d ' ');
+  if [ "$count" -eq 0 ]; then echo "OK: all org members have 2FA enabled";
+  else echo "WARNING: $count member(s) without 2FA:"; cat /tmp/2fa-disabled.txt; fi
+variables:
+  org:
+    default: "your-org"
+    description: GitHub organization login to audit.
+compatible_agents: [generic, claude, codex]
+notes: Requires gh CLI authenticated as an org owner/admin — the 2fa_disabled filter needs admin:org scope.

package/jobs/security/dependabot-alert-digest.yaml

@@ -0,0 +1,30 @@
+id: dependabot-alert-digest
+version: 1
+name: Dependabot Alert Digest
+description: >
+  Rolls up open Dependabot security alerts across a repo into one digest.
+  Use this if Dependabot alerts have ever piled up in a tab nobody checks
+  instead of getting triaged as they come in.
+category: security
+tags: [security, dependabot, github]
+schedule: "0 8 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v gh >/dev/null 2>&1 || { echo "ERROR: gh CLI not installed"; exit 1; };
+  count=$(gh api "repos/{{owner}}/{{repo}}/dependabot/alerts?state=open" --jq 'length' 2>/dev/null);
+  if [ -z "$count" ]; then echo "ERROR: could not fetch Dependabot alerts (check gh auth and repo access)"; exit 1;
+  elif [ "$count" -eq 0 ]; then echo "OK: no open Dependabot alerts";
+  else
+    echo "$count open Dependabot alert(s):";
+    gh api "repos/{{owner}}/{{repo}}/dependabot/alerts?state=open" --jq '.[] | "- " + .security_advisory.severity + ": " + .security_advisory.summary';
+  fi
+variables:
+  owner:
+    default: "your-org"
+    description: GitHub repo owner/org.
+  repo:
+    default: "your-repo"
+    description: GitHub repo name.
+compatible_agents: [generic, claude, codex]
+notes: Requires gh CLI authenticated with a token that has security_events read access on the repo.

package/jobs/security/expiring-api-key-rotation.yaml

@@ -0,0 +1,31 @@
+id: expiring-api-key-rotation
+version: 1
+name: Expiring API Key Rotation Reminder
+description: >
+  Warns you before a third-party API key or token you're tracking expires.
+  Use this if an integration has ever gone down in production because a
+  key expired and nobody rotated it in time.
+category: security
+tags: [security, api-keys, rotation]
+schedule: "0 8 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  today=$(date +%s);
+  awk -F, -v today="$today" -v warn={{warn_days}} '
+    NR>1 {
+      cmd="date -d \"" $2 "\" +%s 2>/dev/null || date -jf \"%Y-%m-%d\" \"" $2 "\" +%s";
+      cmd | getline exp_ts; close(cmd);
+      days_left = int((exp_ts - today) / 86400);
+      if (days_left <= warn) print "WARNING: key \"" $1 "\" expires in " days_left " days (" $2 ")";
+    }
+  ' {{keys_csv}}
+variables:
+  keys_csv:
+    default: "api-keys.csv"
+    description: "CSV with header row, columns: key_name,expiry_date(YYYY-MM-DD)."
+  warn_days:
+    default: 14
+    description: Days before expiry to start warning.
+compatible_agents: [generic, claude, codex]
+notes: Keep api-keys.csv updated manually as a lightweight registry — most providers don't expose expiry via a common API.

package/jobs/security/tls-cipher-weak-check.yaml

@@ -0,0 +1,31 @@
+id: tls-cipher-weak-check
+version: 1
+name: Weak TLS Cipher/Protocol Check
+description: >
+  Checks a host for weak TLS protocol versions or ciphers still enabled.
+  Use this if a legacy protocol has ever stayed enabled for "just in
+  case" long after every client that needed it was gone.
+category: security
+tags: [security, tls, ciphers]
+schedule: "0 6 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v openssl >/dev/null 2>&1 || { echo "ERROR: openssl not installed"; exit 1; };
+  weak_found=0;
+  for proto in ssl3 tls1 tls1_1; do
+    if openssl s_client -connect {{host}}:{{port}} -$proto </dev/null 2>/dev/null | grep -q "Cipher is"; then
+      echo "WARNING: {{host}}:{{port}} accepts $proto";
+      weak_found=1;
+    fi;
+  done;
+  if [ "$weak_found" -eq 0 ]; then echo "OK: {{host}}:{{port}} does not accept SSLv3/TLS1.0/TLS1.1"; else exit 1; fi
+variables:
+  host:
+    default: "example.com"
+    description: Hostname to check.
+  port:
+    default: 443
+    description: Port to check.
+compatible_agents: [generic, claude, codex]
+notes: Requires an openssl build with legacy protocol support compiled in to actually detect them; a modern openssl that's dropped them entirely will just fail to connect either way (still safe).

package/jobs/security/waf-rule-change-watch.yaml

@@ -0,0 +1,38 @@
+id: waf-rule-change-watch
+version: 1
+name: WAF Rule Change Watch
+description: >
+  Diffs your current WAF rules against a saved baseline and flags drift.
+  Use this if a WAF rule has ever been loosened "just for testing" and
+  never put back.
+category: security
+tags: [security, waf, drift]
+schedule: "0 6 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v aws >/dev/null 2>&1 || { echo "ERROR: aws CLI not installed"; exit 1; };
+  aws wafv2 get-web-acl --name {{web_acl_name}} --scope {{scope}} --id {{web_acl_id}} --query 'WebACL.Rules' --output json > /tmp/waf-current.json 2>/dev/null;
+  if [ ! -s /tmp/waf-current.json ]; then echo "ERROR: could not fetch WAF rules for {{web_acl_name}}"; exit 1; fi;
+  if [ -f {{baseline_file}} ]; then
+    if diff -q {{baseline_file}} /tmp/waf-current.json >/dev/null; then echo "OK: WAF rules match baseline";
+    else echo "DRIFT DETECTED in {{web_acl_name}} rules:"; diff {{baseline_file}} /tmp/waf-current.json; exit 1; fi
+  else
+    echo "no baseline at {{baseline_file}} yet — copying current rules as the new baseline";
+    cp /tmp/waf-current.json {{baseline_file}};
+  fi
+variables:
+  web_acl_name:
+    default: "your-web-acl"
+    description: Name of the AWS WAFv2 Web ACL to check.
+  web_acl_id:
+    default: "your-web-acl-id"
+    description: ID of the Web ACL.
+  scope:
+    default: "REGIONAL"
+    description: WAF scope, REGIONAL or CLOUDFRONT.
+  baseline_file:
+    default: "waf-baseline.json"
+    description: Path to the saved baseline rules file to diff against.
+compatible_agents: [generic, claude, codex]
+notes: Written for AWS WAFv2 — adapt the fetch command for Cloudflare, Azure Front Door, or other WAF providers.

package/jobs/support/csat-score-watch.yaml

@@ -0,0 +1,32 @@
+id: csat-score-watch
+version: 1
+name: CSAT Score Watch
+description: >
+  Checks your recent customer satisfaction score and flags it if it drops
+  below your target. Use this if CSAT only gets looked at once a quarter,
+  by which point a bad week is old news.
+category: support
+tags: [support, csat, customer-satisfaction]
+schedule: "0 9 * * 1"
+timezone: "UTC"
+runner: agent-prompt
+prompt: |
+  Check the CSAT (or equivalent satisfaction) score for the last
+  {{lookback_days}} days from {{csat_source_hint}}.
+  1. Compare it to the {{target_score}} target.
+  2. If below target, pull 2-3 representative low-scoring responses to
+     show what's driving it.
+  3. Report the score, trend vs. the prior period, and the drivers if
+     applicable, in under 150 words.
+variables:
+  csat_source_hint:
+    default: "helpdesk tool (Zendesk, Intercom, etc.)"
+    description: Where CSAT/satisfaction survey data lives.
+  lookback_days:
+    default: 7
+    description: Rolling window to evaluate.
+  target_score:
+    default: 90
+    description: Target CSAT score (percent or your tool's native scale).
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: No generic script mode — CSAT scoring and survey formats vary too much by helpdesk tool for a fixed command.

package/jobs/support/sla-breach-warning.yaml

@@ -0,0 +1,31 @@
+id: sla-breach-warning
+version: 1
+name: SLA Breach Warning
+description: >
+  Flags open tickets that are about to breach their SLA, before they
+  actually do. Use this if a ticket has ever blown past its SLA with zero
+  warning because the only check was after the fact.
+category: support
+tags: [support, sla, tickets]
+schedule: "*/15 * * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  count=$(curl -s -H "Authorization: Bearer {{api_token}}" "{{api_url}}" | grep -o '"status":"open"' | wc -l | tr -d ' ');
+  if [ -z "$count" ] || [ "$count" -eq 0 ]; then echo "OK: no tickets approaching SLA breach"; exit 0;
+  else echo "WARNING: $count ticket(s) within {{warn_minutes}} minutes of SLA breach at {{api_url}}"; exit 1; fi
+variables:
+  api_url:
+    default: "https://api.example-helpdesk.com/tickets?status=open&sla_remaining_lt_minutes=30"
+    description: Helpdesk API endpoint pre-filtered to tickets close to breaching SLA.
+  api_token:
+    default: "your-api-token"
+    description: Bearer token for the helpdesk API.
+  warn_minutes:
+    default: 30
+    description: Minutes of SLA time remaining that counts as "about to breach", for labeling output.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Proactive counterpart to `ticket-backlog-aging-check` (which flags
+  tickets already past SLA) — point api_url at your helpdesk's filtered
+  search for tickets still within SLA but running low on time.

package/jobs/support/ticket-backlog-aging-check.yaml

@@ -0,0 +1,30 @@
+id: ticket-backlog-aging-check
+version: 1
+name: Support Ticket Backlog Aging Check
+description: >
+  Checks how many open support tickets have sat unanswered past your SLA
+  window. Use this if tickets have ever quietly aged past their SLA
+  because the backlog view wasn't checked that day.
+category: support
+tags: [support, sla, tickets]
+schedule: "0 */4 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v curl >/dev/null 2>&1 || { echo "ERROR: curl not installed"; exit 1; };
+  count=$(curl -s -H "Authorization: Bearer {{api_token}}" "{{api_url}}" | grep -o '"status":"open"' | wc -l | tr -d ' ');
+  if [ -z "$count" ] || [ "$count" -eq 0 ]; then echo "OK: no aging open tickets found (or endpoint returned nothing)"; exit 0;
+  elif [ "$count" -ge "{{threshold}}" ]; then echo "WARNING: $count open tickets past SLA at {{api_url}}"; exit 1;
+  else echo "OK: $count open tickets past SLA (under threshold {{threshold}})"; fi
+variables:
+  api_url:
+    default: "https://api.example-helpdesk.com/tickets?status=open&age_gt_hours=24"
+    description: Helpdesk API endpoint pre-filtered to tickets past your SLA age.
+  api_token:
+    default: "your-api-token"
+    description: Bearer token for the helpdesk API.
+  threshold:
+    default: 5
+    description: Number of aging open tickets that triggers a warning.
+compatible_agents: [generic, claude, codex]
+notes: Generic REST pattern — point api_url at your helpdesk's (Zendesk, Intercom, Freshdesk) filtered ticket search endpoint; adjust the grep pattern to match its response shape.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wonsukchoi/crondex",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "A public directory of pre-made, agent-editable cron jobs.",
   "type": "module",
   "license": "MIT",