Reminder OC Cron Based

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:19 AM UTC
• Version: 0.1.0

Overview

This skill coherently manages OpenClaw chat reminders and its persistent cron behavior is disclosed and bounded to that purpose.

Install only if you want OpenClaw cron-based chat reminders. Prefer the native cron tool path when available, and use the helper script only in a trusted local environment with the expected OpenClaw binary and intended channel/account routing variables.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs use of a local helper script via `python3 scripts/reminder_cron.py ...` and references environment-dependent CLI behavior, which implies shell and environment access, but the skill declares no explicit tool scope or allowed-tools restrictions. That mismatch can cause overbroad execution authority in hosts that infer capabilities loosely, increasing the chance of unintended command execution or exposure to environment-specific secrets and routing data.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_openclaw(args):
    cmd = [OPENCLAW_BIN, "cron", *args]
    proc = subprocess.run(cmd, capture_output=True, text=True)
    if proc.returncode != 0:
        raise SystemExit(proc.stderr.strip() or proc.stdout.strip() or f"command failed: {' '.join(cmd)}")
    return proc.stdout.strip()

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Tainted flow: 'cmd' from os.environ.get (line 86, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

def run_openclaw(args):
    cmd = [OPENCLAW_BIN, "cron", *args]
    proc = subprocess.run(cmd, capture_output=True, text=True)
    if proc.returncode != 0:
        raise SystemExit(proc.stderr.strip() or proc.stdout.strip() or f"command failed: {' '.join(cmd)}")
    return proc.stdout.strip()

• Confidence: 78% confidence
• Finding: The executable name comes from OPENCLAW_BIN, which is taken directly from the environment and then executed. If an attacker can influence the environment of this script, they can cause it to run an arbitrary program under the script's privileges, making this a command-execution primitive even though shell=True is not used.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The file includes bilingual release notes with Chinese text for each English entry, but there is no indication that language presentation is optional or tied to a documented regional requirement. Under the language/locale policy check, this can be read as imposing a specific locale format without user opt-in.

Static analysis

No suspicious patterns detected.