tklr-reminders

• Outcome: Review
• Latest audit: Aug 9, 2026 · 3:49 AM UTC
• Version: 1.0.0

Overview

This reminder skill has a coherent purpose, but it installs persistent scheduled delivery and can run stored alert commands, so it needs careful review before use.

Install only if you want this skill to manage reminders through Hermes/tklr and are comfortable with it creating persistent files, a scheduled dispatcher, and delivery commands on your machine. Review the configured alert channels and himalaya email setup first, and avoid using broad or raw command routes unless you understand that they can execute later when reminders fire.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (12)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not script.is_file():
        die(f"install.sh is missing from {SKILL_SCRIPTS}")
    try:
        proc = subprocess.run(["bash", str(script), "--home", str(home)],
                              capture_output=True, text=True, timeout=900)
    except (OSError, subprocess.SubprocessError) as exc:
        die(f"could not run install.sh: {exc}")

• Confidence: 88% confidence
• Finding: proc = subprocess.run(["bash", str(script), "--home", str(home)], capture_output=True, text=True, timeout=900)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

argv[0] = resolved

    try:
        proc = subprocess.run(argv, capture_output=True, text=True, timeout=SEND_TIMEOUT)
    except FileNotFoundError:
        return False, False, f"command not found: {argv[0]}"
    except subprocess.TimeoutExpired:

• Confidence: 98% confidence
• Finding: proc = subprocess.run(argv, capture_output=True, text=True, timeout=SEND_TIMEOUT)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to run shell commands, read reference files, and write configuration/state, yet it declares no permissions. That mismatch is dangerous because it hides the skill's true capabilities from reviewers and policy enforcement, increasing the chance of unauthorized execution or filesystem changes during routine use.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script exposes an additional capability, `--mail-accounts`, that reads a separate local application's configuration and derives account addresses from it. Even though it tries not to print secrets, this is cross-scope access to potentially sensitive local configuration and can disclose private email identities unrelated to the core task of editing alert channels, which is especially relevant in an agent skill context where tools may be invoked indirectly.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README instructs users to run a setup command that installs software, creates configuration and database files, installs a dispatcher, creates a cron job, auto-targets the current chat, and sends a test reminder, but it does not present a prominent safety/privacy warning immediately before execution. This is risky because users may trigger persistent system and messaging changes without informed consent, especially in an agent-driven environment where side effects extend beyond the current session.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The description uses very broad routing terms such as 'calendar', 'schedule', 'events', 'tasks', and 'alerts', which are likely to match many ordinary conversations. Because the skill also contains strong instructions to autonomously execute setup and shell actions, over-triggering increases the chance that it activates in contexts where the user did not intend operational changes.

Missing User Warnings

Low

• Confidence: 98% confidence
• Finding: `chat_send_command` builds a complete shell command by directly interpolating `target` and especially `message` into a string that is later stored and executed by the dispatcher shell. Because the docstring explicitly says placeholders remain in the message and the dispatcher runs the stored string, any shell metacharacters in message/template content can become command injection when reminders are delivered.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This script performs destructive calendar mutations (delete and reschedule) immediately once invoked, with no mandatory confirmation gate in normal mode. In an agent-skill context, that increases the risk of accidental or prompt-induced deletion/rescheduling of reminders, especially because the tool is explicitly designed to bypass missing CLI safeguards and call internal mutation APIs directly.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

later. It is idempotent, so run it even if you think setup is already done.

The platform is the one this conversation is on — your own instructions name
it. Do not ask the user, and do not pick from `hermes send --list`. Never guess
an address either — leave `--email` off and the offer asks for it.

**Do not split this into steps.** Every failed setup in this skill's history

• Confidence: 93% confidence
• Finding: Do not ask the user

Unvalidated Output Injection

High

• Category: Output Handling

Content

argv[0] = resolved

    try:
        proc = subprocess.run(argv, capture_output=True, text=True, timeout=SEND_TIMEOUT)
    except FileNotFoundError:
        return False, False, f"command not found: {argv[0]}"
    except subprocess.TimeoutExpired:

• Confidence: 96% confidence
• Finding: subprocess.run(argv, capture_output

Session Persistence

Medium

• Category: Rogue Agent

Content

That loads the skill and it takes it from there: installs tklr, creates the workspace, installs the alert dispatcher, creates the cron job, points alerts at the chat you are already talking in, and sends you a test reminder to confirm delivery works.

**On Matrix and Slack, type `!tklr-reminders setup` instead.** Those clients reserve `/` for their own commands, so a typed `/` never reaches Hermes; their adapters accept `!` and rewrite it. Every other platform uses `/`.

**Include the word `setup`; it does real work.** Anything you type after the command is passed through to the agent as your instruction, and it is placed at the very end of the message, after the skill and after the file listing Hermes appends. That last position is the one the agent acts on most reliably. A bare `/tklr-reminders` gives it a document and no task, and smaller local models tend to respond by describing the skill or offering you a menu instead of setting it up. One word fixes it.

• Confidence: 88% confidence
• Finding: write it. Every other platform uses `/`. **Include the word `setup`; it does real work.** Anything you type after the command is passed through to the agent as your instruction, and it is placed at t

Chaining Abuse

High

• Category: Tool Misuse

Content

step "tklr workspace (YOUR REMINDERS)"
if [[ -d "$TKLR_HOME" ]]; then
    act "rm -rf $TKLR_HOME"
    [[ $DRY_RUN -eq 0 ]] && rm -rf "$TKLR_HOME"
else
    skip "$TKLR_HOME"
fi

• Confidence: 86% confidence
• Finding: && rm -

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.