v0.1.1

Reminder Guardian

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 5:52 AM.

Analysis

The skill mostly matches its reminder purpose, but its code appears to call a time-helper path outside the packaged skill, so it should be reviewed before installation.

GuidanceBefore installing, ask the publisher to fix or explain the time-helper path so only the bundled helper is executed. If you proceed, review each cron blueprint before scheduling, confirm python3 and openclaw are available, and avoid storing sensitive information in reminder messages or notes.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityMediumConfidenceHighStatusConcern

scripts/reminder_guard.py

SKILL_ROOT = Path(__file__).resolve().parents[2]
TIME_HELPER = SKILL_ROOT / "scripts" / "time_helper.py"
...
result = subprocess.run(cmd, capture_output=True, text=True)

The packaged helper is supplied as scripts/time_helper.py, but reminder_guard.py is itself under scripts/. Using parents[2] points above the skill root before appending scripts/time_helper.py, so the normal helper call can target an unprovided external path rather than the bundled helper.

User impactReminder commands may fail, or they may execute a time-helper file outside the reviewed skill package if such a file exists in the resolved location.

RecommendationHave the helper path corrected or verified so it calls the bundled reminder-guardian/scripts/time_helper.py before installing or relying on the skill.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

Create the cron job: Copy the printed blueprint and run `openclaw cron add`

The skill asks the user to create a scheduled job from a generated blueprint. This is purpose-aligned and manual, but scheduled jobs are persistent actions that should be reviewed.

User impactIf the user schedules the wrong blueprint or delivery channel, the reminder may fire at the wrong time or with unintended text.

RecommendationReview the generated JSON blueprint, schedule time, label, message, and delivery channel before running openclaw cron add.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityLowConfidenceHighStatusNote

scripts/reminder_guard.py

LOG_PATH = REPO_ROOT / "memory" / "reminder-log.json"
...
"message": args.message,
"note": args.note,

Reminder messages and optional notes are stored in a persistent local JSON file and later reused for listings and cron blueprints.

User impactPrivate reminder contents can remain on disk and may reappear in future reminder outputs or scheduled-event payloads.

RecommendationAvoid putting secrets in reminders, periodically clean the log if needed, and verify that memory/reminder-log.json is excluded from any version-control or backup workflows you do not intend.