Security audit
Security checks for vulnerabilities and agentic risk
This skill can read Remind data, send messages to entire classes, and change notifications, but its shell workflow lacks a clear approval requirement for writes.
Treat this as a write-capable integration. Require explicit approval of recipients and message text before sending, and approval before changing notification delivery. For reading alone, use a workflow that rejects mutations. Protect the saved session like a password and delete it when no longer needed. The bundled instructions were fully reviewed, but the external CLI, extension, and live service behavior were not audited.
The description declares read access, including reading notification settings. The supplied commands instead invoke updateAccountNotificationsScreen mutations with devicesToDisable and devicesToEnable, changing account notification delivery settings. Re-enabling the device afterward does not make these operations read-only.
The declared purpose is reading Remind data, but the supplied command performs a message-creation mutation. Sending a message changes application state and is not merely a supporting implementation detail for reading data.
The manifest describes reading classes, chats, and messages, but L153–L154 provide a putMessage mutation that sends content to a conversation. L157 also documents whole-class recipients, extending the capability to communications with real people rather than data retrieval; the statement that this example was not executed does not remove the provided write capability.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
chmod 600 ~/.remind-fpx-session.json
> Use a session file of your own like this one. Do **not** write into `~/.remind-mcp/` — that is
> the MCP server's store, with a different schema; overwriting it corrupts its session.
## The call pattern
The manifest at L003 describes reading Remind data, but the rq helper submits arbitrary caller-supplied GraphQL documents with session cookies and a CSRF token, without restricting them to queries. This write capability is explicitly intentional: L089–L091 discuss sending messages, warn that writes reach real people, and direct users to mutation shapes in the references file.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
local S=~/.remind-fpx-session.json
local body; body=$(Q="$1" V="${2:-{\}}" node -e '
process.stdout.write(JSON.stringify({query:process.env.Q,variables:JSON.parse(process.env.V)}))')
curl -s -X POST https://www.remind.com/graphql \
-H 'content-type: application/json' \
-H "cookie: $(node -e 'console.log(require(process.argv[1]).capturedHeaders.cookie)' "$S")" \
-H "x-csrf-token: $(node -e 'console.log(require(process.argv[1]).capturedHeaders["x-csrf-token"])' "$S")" \
The manifest describes reading Remind data, including notification settings. The commands at L142–L145 instead disable and enable delivery devices, changing account state and potentially interrupting notifications; L138 explicitly states this capability was verified live.