Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

rem

v1.0.0

Manages macOS Reminders from the terminal using the rem CLI. Creates, lists, updates, completes, deletes, searches, and exports reminders and lists. Supports...

0· 356·0 current·0 all-time
bySiddhartha Varma@bro3886
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
The skill's name and description (manage macOS Reminders) align with the instructions: it targets macOS, EventKit/osascript, offers reminder CRUD, search, import/export, and shows how to use the rem CLI or its Go API. No unrelated APIs, binaries, or credentials are requested.
!
Instruction Scope
The SKILL.md instructs running a network installer (curl -fsSL https://rem.sidv.dev/install | bash) and provides commands to install the skill into multiple agent-specific directories (e.g. ~/.openclaw/skills/rem-cli/). Those installer-and-agent-install steps go beyond simple local CLI usage: they instruct fetching and executing remote code and modifying agent runtime directories, which could change agent behavior or persist code into agent sandboxes.
!
Install Mechanism
There is no formal install spec in the manifest; the README recommends piping a script from rem.sidv.dev into bash (high-risk). An alternative 'go install github.com/BRO3886/rem/...' is listed (lower risk), but the primary recommended curl|bash installation from an unvetted domain is an unsafe pattern unless you inspect the script. No cryptographic signatures or well-known release-hosting (e.g., verified GitHub releases) are referenced for the curl installer.
Credentials
The skill declares no required environment variables or credentials. The docs mention optional env flags like REM_NO_UPDATE_CHECK and NO_COLOR, which are reasonable. There are no requests for unrelated secrets or system credentials.
!
Persistence & Privilege
The docs explicitly provide commands to install/uninstall the rem skill into multiple AI agent directories (Claude, Codex, OpenClaw). Installing into these locations would give the skill a persistent presence in agent runtimes and allow the agent to run the installed code later. While 'always' is false, combining a remote installer with instructions to write into agent skill folders raises the potential for persistent or broadly scoped changes to agent behavior.
What to consider before installing
Do not run the curl | bash installer blindly. Before installing, do one of the following: (1) Inspect the installer script at https://rem.sidv.dev/install in a browser (or curl it to stdout) to see exactly what it does; (2) Prefer building from source via the listed GitHub module (go install github.com/BRO3886/rem/...) and verify the repository, recent commits, and release tags; (3) If you must run the remote installer, run it in a sandbox/VM and review its network activity and files written; (4) Avoid using the 'rem skills install' commands that write into agent skill directories unless you have inspected the code that will be installed — installing into agent directories grants the skill persistent execution inside those agents; (5) Check for signed releases or release artifacts on an authoritative repository and verify the maintainer identity. If you want, provide the contents of the install script or the GitHub repo URL for a follow-up review.

Like a lobster shell, security has layers — review code before you run it.

latestvk9750dkdbm21dkfwdxbtd6xptd8206xg
356downloads
0stars
1versions
Updated 7h ago
v1.0.0
MIT-0

rem — CLI for macOS Reminders

A Go CLI that wraps macOS Reminders. Sub-200ms reads via cgo + EventKit. Single binary, no dependencies at runtime.

Installation

# macOS (recommended)
curl -fsSL https://rem.sidv.dev/install | bash

# Or via Go
go install github.com/BRO3886/rem/cmd/rem@latest

Install this skill into your agent:

# Claude Code or Codex
rem skills install

# OpenClaw
rem skills install --agent openclaw

Quick Start

# See all lists with reminder counts
rem lists --count

# Add a reminder with natural language date
rem add "Buy groceries" --list Personal --due tomorrow --priority high

# List incomplete reminders in a list
rem list --list Work --incomplete

# Search across all reminders
rem search "meeting"

# Complete a reminder by short ID
rem complete abc12345

# View stats
rem stats

Command Reference

Reminder CRUD

CommandAliasesDescription
rem addcreate, newCreate a reminder
rem listlsList reminders with filters
rem showgetShow full details of one reminder
rem updateeditUpdate reminder properties
rem deleterm, removeDelete a reminder
rem completedoneMark reminder complete
rem uncompleteMark reminder incomplete
rem flagFlag a reminder
rem unflagRemove flag

List Management

CommandAliasesDescription
rem listsShow all lists
rem list-mgmt createlm newCreate a list
rem list-mgmt renameRename a list
rem list-mgmt deletelm rmDelete a list

Search & Analytics

CommandDescription
rem search <query>Search title and notes
rem statsShow statistics and per-list breakdown
rem overdueShow overdue reminders
rem upcomingShow reminders due in next N days (default: 7)

Import/Export

CommandDescription
rem exportExport to JSON or CSV
rem import <file>Import from JSON or CSV file

Skills & Other

CommandDescription
rem skills installInstall rem skill for AI agents
rem skills uninstallUninstall rem skill from AI agents
rem skills statusShow skill installation status
rem interactive / rem iInteractive menu-driven mode
rem versionPrint version
rem completionGenerate shell completions (bash/zsh/fish)

For full flag details on every command, see references/commands.md.

Key Concepts

Short IDs

Reminders have UUIDs like x-apple-reminder://AB12CD34-.... The CLI displays the first 8 characters as a short ID (AB12CD34). You can pass any unique prefix to commands — rem complete AB1 works if it matches exactly one reminder.

Natural Language Dates

The --due flag accepts natural language:

rem add "Call dentist" --due tomorrow
rem add "Submit report" --due "next friday at 2pm"
rem add "Quick task" --due "in 30 minutes"
rem add "Wrap up" --due eod

Supported patterns: today, tomorrow, next monday, in 3 hours, eod, eow, 5pm, 2026-02-15, and more. See references/dates.md for the full list.

Priority Levels

LevelFlag valueAppleScript value
High--priority high1 (range 1-4)
Medium--priority medium5
Low--priority low9 (range 6-9)
None--priority none0

Output Formats

All read commands support -o / --output:

  • table (default) — formatted table with borders
  • json — machine-readable JSON
  • plain — simple text, one item per line

The NO_COLOR environment variable is respected.

URL Storage

macOS Reminders has no native URL field. rem stores URLs in the notes/body field with a URL: prefix and extracts them for display.

Common Workflows

Daily review

rem overdue                          # Check what's past due
rem upcoming --days 1                # See today's reminders
rem list --list Work --incomplete    # Focus on work items

Batch operations with JSON

rem export --list Work --format json > backup.json
rem import backup.json --list "Work Archive"

Scripting with JSON output

# Get overdue count
rem overdue -o json | jq 'length'

# List all incomplete reminder titles
rem list --incomplete -o json | jq -r '.[].name'

Public Go API

For programmatic access, use go-eventkit directly:

import "github.com/BRO3886/go-eventkit/reminders"

client, _ := reminders.New()
r, _ := client.CreateReminder(reminders.CreateReminderInput{
    Title:    "Buy milk",
    ListName: "Shopping",
    Priority: reminders.PriorityHigh,
})
items, _ := client.Reminders(reminders.WithCompleted(false))

See go-eventkit docs for the full API surface.

Limitations

  • macOS only — requires EventKit framework and osascript
  • No tags, subtasks, or recurrence — not exposed by EventKit/AppleScript
  • --flagged filter is slower (~3-4s) — falls back to JXA since EventKit doesn't expose flagged
  • List deletion may fail on some macOS versions

Comments

Loading comments...