Channel Reminders

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill is a disclosed reminder scheduler, but its persistent message-routing instructions include a fixed Telegram chat target that could send reminders to the wrong recipient if copied as-is.

Install only if you are comfortable with persistent scheduled reminders and Telegram message delivery. Before creating jobs, replace the hardcoded example chat ID with your own verified chat, confirm each recipient and bot account, keep the Telegram bot token private, and periodically remove old cron jobs and memory entries.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A reminder may be delivered to an unintended Telegram chat or through an unintended bot account if the example target is reused or a scheduled payload is malformed.

Why it was flagged

The skill routes scheduled systemEvent content into a message-sending tool and shows a concrete Telegram target ID. Without validation or replacement, reminders could be sent via the wrong bot or to the wrong chat.

Skill content
Main агент парсит accountId, target, message ... Main агент отправляет через `message` tool с указанным accountId ... target: 7977422300
Recommendation

Before using it, replace any example chat ID with the current user-approved chat, verify accountId and target for every job, and require confirmation before creating message-tool reminders.

What this means

Reminders can keep firing in future sessions, including recurring reminders, until the user lists and removes or disables the cron jobs.

Why it was flagged

The skill intentionally creates scheduled jobs that wake the main agent and continue running until removed or disabled.

Skill content
Всегда указывай `"wakeMode": "now"` ... `cron list` ... `cron remove jobId: "uuid"` ... `cron update jobId: "uuid" patch: { enabled: false }`
Recommendation

Review scheduled jobs regularly, set clear end conditions for recurring reminders, and remove jobs that are no longer needed.

What this means

Anyone who obtains the bot token may be able to interact with the Telegram bot within its permissions.

Why it was flagged

The skill references a Telegram bot token for discovering the chat ID. This is expected for Telegram delivery, but the token is sensitive.

Skill content
curl "https://api.telegram.org/bot<BOT_TOKEN>/getUpdates" | jq '.result[].message.chat.id'
Recommendation

Use the token only locally, avoid pasting it into chats or shared logs, and rotate it if it is exposed.

What this means

A Telegram chat ID and routing preference may remain in agent memory and be reused later, including if the stored ID is incorrect.

Why it was flagged

The skill asks the agent to persist reminder routing details and a chat ID in memory, so future tasks may reuse that data.

Skill content
После тестов **запиши в память** какой подход работает ... **Chat ID пользователя:** 7977422300
Recommendation

Store only the actual user-approved chat ID, avoid hardcoded example IDs, and delete the memory entry when reminders are no longer needed.