Security audit
remind-me
Security checks for vulnerabilities and agentic risk
Overview
The skill's high-level purpose (natural-language reminders) matches the scripts, but there are multiple inconsistencies and runtime dependencies (not declared) that could cause failures or allow execution of arbitrary code via npx; review before installing.
This skill appears to implement reminders, but several mismatches increase risk: - The bash scripts call `npx tsx src/index.ts ...` to create/deliver jobs, but the referenced Node/TypeScript program (src/index.ts) is not included and Node tooling (npx/tsx/node) is not declared as a requirement. Ask the publisher to provide or point to the exact Node project and to declare required binaries. - If `npx` runs and the local project is missing, it may download and execute code from the network (npm), which can run arbitrary code on your system. Do not install/run this skill unless you (or the publisher) can show and review the Node/TS source that will be executed. - The skill requires a recipient ID (TO) and a timezone; confirm where channel credentials (e.g., Telegram/Slack tokens) are stored and whether they will be requested or reused by the external CLI. Unclear credential handling is a red flag. Recommended next steps before installing: 1. Request the missing Node project (src/index.ts and package.json) and review its code and network behavior. Ensure package versions are pinned. 2. Ensure your environment has Node, npx, and tsx if you intend to run it; update the skill metadata to list these binaries. 3. Verify the delivery mechanism (what service endpoints it contacts and where tokens live). Prefer explicit, documented credential requirements rather than implicit assumptions. 4. Back up or inspect the reminders file path and permissions; consider running in a contained environment first. If you cannot obtain and review the Node code and confirm exactly what `npx tsx` will run, treat this skill as potentially unsafe.
Static analysis
No suspicious patterns detected.