ClawHub
Back to skill

Security audit

rem

Security checks for vulnerabilities and agentic risk

Overview

The skill’s reminder features are coherent, but its recommended install path runs mutable remote code and it can write into AI-agent skill directories.

Review this carefully before installing. Prefer a pinned, signed, or checksum-verified release instead of the `curl | bash` or `@latest` paths, and be aware that `rem skills install` can write files into AI-agent skill directories that may affect future agent sessions. Use destructive reminder/list commands without `--force` unless you have reviewed the target.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Remote Installer Is Downloaded and Executed Without Verification

SKILL.md:18

Vulnerability Details

File Location: SKILL.md, line 18
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://rem.sidv.dev/install | bash

Technical Analysis

The recommended installation command streams a response from an external domain directly into Bash. The retrieved script is not included in the audited project and is not pinned to an immutable version, inspected before execution, or authenticated through a cryptographic signature or documented checksum.

HTTPS protects the connection under normal conditions, but it does not establish that every future response from the server is safe. The effective payload can change after the Skill has been reviewed. Compromise of the hosting account, domain, server, certificate issuance process, or deployment pipeline could therefore turn this command into an arbitrary-code execution channel.

Directly executing mutable network content is unnecessary for the declared reminder-management functionality and exceeds the minimum privileges needed to distribute a CLI. Users can instead download and verify a versioned artifact before running or installing it.

Attack Path

  1. An attacker compromises or gains control over rem.sidv.dev, its deployment pipeline, or the hosted installer.
  2. The attacker replaces the installer response with a malicious shell script.
  3. A user or agent follows the documented installation command.
  4. curl retrieves the attacker-controlled response and pipes it directly to Bash without local review or integrity verification.
  5. Bash executes the payload with all permissions available to the invoking user.
  6. The payload can access user-readable data, modify user-writable files, install persistence within the user's account, or download and execute additional components.

Impact Assessment

Successful exploitation provides arbitrary command execution with t ...[truncated 665 chars]

Remediation

Remediation Suggestions

  • Remove the curl | bash installation pattern.
  • Publish versioned, immutable release artifacts through a trusted release channel.
  • Document a two-step installation process that downloads the artifact before any execution occurs.
  • Publish a SHA-256 checksum through a separately protected channel and require users to verify it before installation.
  • Prefer cryptographic release signatures with documented key verification and rotation procedures.
  • Pin documentation to a specific reviewed release rather than a mutable installer endpoint.
  • Ensure the installer never requests elevated privileges unless a clearly identified operation strictly requires them.
  • Provide the installer source in the audited repository so its filesystem changes, network behavior, and privilege requirements can be reviewed.

T08 · Insecure Dependencies

Warning

Go Installation Uses an Unpinned Latest Upstream Release

SKILL.md:21

Vulnerability Details

File Location: SKILL.md, line 21
Vulnerability Type: Insecure dependency and supply-chain installation
Risk Level: Medium

Vulnerable Code:

bash
go install github.com/BRO3886/rem/cmd/rem@latest

Technical Analysis

The alternative installation method uses the mutable @latest selector. Consequently, the source revision built by the command can change independently of this Skill and after the audit has concluded. The project does not identify a reviewed version or commit, provide checksums or signatures, or include the CLI source needed to compare the installed implementation with the documented behavior.

This is a supply-chain weakness rather than evidence that the named upstream repository is currently compromised. If the upstream repository, release process, maintainer account, or relevant dependency chain is compromised, a future version selected by @latest could contain behavior not represented by the audited documentation.

Pinning a reviewed version or immutable commit is necessary to make installation reproducible and to bind the executable to an auditable source state.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or its release pipeline.
  2. The attacker publishes a newer malicious version that becomes the version resolved by @latest.
  3. A user follows the documented go install command.
  4. The Go tool downloads and compiles the attacker-controlled source into a local rem executable.
  5. When the user or agent invokes rem, the malicious program executes with the invoking user's permissions.
  6. Because the documented CLI legitimately handles reminders, imported files, exported data, and agent skill directories, malicious behavior could be concealed within apparently normal operations.

Impact Assessment

Exploitation can result in installation of a malicious executable and arbitrary behavior when that e ...[truncated 518 chars]

Remediation

Remediation Suggestions

  • Replace @latest with a specific reviewed semantic version or immutable commit identifier.
  • Keep the pinned version consistent with the Skill metadata and update it only through a documented security review.
  • Publish signed release tags and document verification of the maintainer signing key.
  • Provide checksums for corresponding release artifacts and verify them before installation.
  • Include or link to immutable source for the exact reviewed revision.
  • Use automated dependency and provenance checks, such as reproducible builds and signed build attestations, before publishing updates.
  • Document the permissions required by the CLI and ensure users are not instructed to run it with sudo.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

External Script Fetching

High
Category
Supply Chain
Content
bash
# macOS (recommended)
curl -fsSL https://rem.sidv.dev/install | bash

# Or via Go
go install github.com/BRO3886/rem/cmd/rem@latest
Confidence
98% confidence
Finding

This line fetches a script from an external domain and executes it directly, creating a classic arbitrary-code-execution path. In the context of an agent skill, this is more dangerous because installation instructions may be followed automatically or semi-automatically, reducing user review and increasing the chance of silent compromise.

Chaining Abuse

High
Category
Tool Misuse
Content
bash
# macOS (recommended)
curl -fsSL https://rem.sidv.dev/install | bash

# Or via Go
go install github.com/BRO3886/rem/cmd/rem@latest
Confidence
97% confidence
Finding

The pipe into bash eliminates the opportunity for meaningful inspection before execution and enables command chaining from untrusted network content directly into a shell. This materially increases the likelihood and impact of supply-chain compromise, especially when presented as the recommended installation path.

Missing User Warnings

Medium
Confidence
95% confidence
Finding

The skill recommends a piped remote installation command without any warning or integrity-verification step. If the remote host, DNS, TLS trust chain, or distribution endpoint is compromised, arbitrary shell code will execute immediately on the user's machine with the user's privileges.

Missing User Warnings

Medium
Confidence
89% confidence
Finding

The markdown describes commands for deleting reminders and lists, as well as import/export workflows, but does not include any caution that deletion may remove user data or that import can modify existing reminder data. For a skill that affects personal task data in Apple Reminders, a brief warning about destructive operations would improve user disclosure.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| Flag | Short | Description | Default |
|------|-------|-------------|---------|
| `--force` | — | Skip confirmation | false |

Aliases: `rm`, `remove`
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| Flag | Short | Description | Default |
|------|-------|-------------|---------|
| `--force` | — | Skip confirmation | false |

Aliases: `rm`, `remove`
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium
Category
Rogue Agent
Content

rem i

text

Menu options: create reminder, list reminders, complete reminder, delete reminder, list all lists, create list, quit.

---
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding

The documented rem skills install/uninstall/status commands extend the tool beyond Apple Reminders management into modifying local AI agent configuration directories. That broadens the trust boundary and creates an unexpected capability for persistence or lateral influence over developer tooling, which is risky in an agent skill context even if presented as a convenience feature.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding

Installing into ~/.claude/skills/, ~/.agents/skills/, or ~/.openclaw/skills/ is unrelated to normal reminder operations and enables writes into trusted AI tool directories. In a skill package, that is especially sensitive because it can establish persistence or alter future agent behavior under the guise of a productivity feature.

Missing User Warnings

Low
Confidence
89% confidence
Finding

This markdown file documents rem export, which can write reminder contents to stdout or a specified output file, but it provides no explicit warning that potentially sensitive reminder titles, notes, and URLs may be persisted or exposed. Under the markdown-file criteria for missing user warnings, data-affecting behavior should be disclosed when it could impact privacy.

Missing User Warnings

Low
Confidence
84% confidence
Finding

The rem import section states that reminders are imported from JSON or CSV and shows --dry-run, but it does not explicitly warn that running the command modifies reminder data by creating items. For markdown documentation, behavior that affects user data should be clearly disclosed.

Static analysis

No suspicious patterns detected.