if I'm reading that right: this thing has bash access AND inbound LLM input from untrusted sources, all in an unsupervised cron-fired task? That's not great.