Security audit

alarm-memo-assistant-pro

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a normal reminder and notes skill, with disclosed local storage and optional scheduled chat reminders.

Install only if you want a Chinese-language reminder, memo, and todo workflow. Before enabling automatic daily digests or reminders, confirm where the data files are stored, how to review or delete them, and whether cron/session delivery is active in your OpenClaw host.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger examples are common, everyday phrases such as setting reminders or taking notes, which increases the chance the skill may be invoked when the user intended a normal conversational exchange rather than this specific skill. In a skill that can create reminders, todos, or scheduled pushes, accidental routing could cause unwanted persistence or automation, making the issue more meaningful than a purely cosmetic trigger mismatch.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The manifest description is written entirely in Chinese and presents the skill as operating in that language, without stating that users may choose another language. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The high-priority trigger phrases are broad enough to match ordinary conversation, which can cause the skill to activate and begin structuring, storing, or scheduling user content without sufficiently clear intent. In a skill that can write files, create reminders, and deliver messages to another session, accidental activation increases the chance of unintended persistence or unsolicited message scheduling.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The weak trigger section permits activation based on vague productivity-related language and contextual interpretation, which makes false positives likely. Because this skill is designed to store structured records and potentially set cron-driven pushes, ambiguous activation can lead to unintended collection, retention, or operational actions on user data.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The playbook is written entirely in Chinese, including headings, guidance, and reminder templates, with no indication that the user may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The file’s instructional content is entirely in Chinese, including prescriptive guidance on how the skill should describe its capabilities. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This markdown file defines all user-facing output templates exclusively in Chinese, including headings and content labels. Because there is no indication that the skill is region-specific or that users can opt into this locale, it appears to impose a language choice in a way that may violate language/locale policy.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The strong trigger list contains very broad everyday phrases such as '记一下', '记录一下', and '清单', which can easily appear in ordinary conversation without the user intending to invoke the skill. In a reminder/memo skill, accidental invocation can cause unintended capture of personal information, creation of reminders, or persistence of user content without clear consent.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The Daily Digest routing includes broad phrases like '今天要做什么' and '发我今日任务', which may be used conversationally as general questions rather than explicit requests to enable task summarization or recurring push behavior. This ambiguity increases the risk of unintended retrieval or proactive sending of task data, especially if the skill can auto-push daily summaries.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The natural-language content in this file switches to Chinese for all substantive entries, which can impose a specific language on readers without any opt-in or explanation. Under the policy rule for language or locale constraints, this is a mild but valid documentation-level violation.

Natural-Language Policy Violations

Low

Confidence: 76% confidence
Finding: All user-facing guidance and example utterances in the README are presented in Chinese, and the document does not state whether this language restriction is intentional, optional, or region-specific. Under the policy, forcing a specific language without opt-in can be a natural-language policy concern.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The skill instructs the agent to use local file storage, cron jobs, and session message delivery, but it does not require an explicit user-facing warning or consent flow for persistence and cross-session delivery. This can surprise users about where their data is stored, how long it persists, and whether reminders or summaries may be sent automatically later.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The schema examples and suggested output are entirely in Chinese, and the timezone example is fixed to Asia/Tokyo, with no indication that language or locale is selectable by the user. This can constitute a natural-language locale policy issue because it implicitly constrains output formatting and language without documenting opt-in or justification.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: All trigger terms, examples, and extraction requirements are written in Chinese, and the document does not state that language choice is optional or region-specific. This can constitute a language/locale policy issue if the skill is expected to support broader users without explicit opt-in.

Static analysis

No suspicious patterns detected.