Ping Me

PassAudited by ClawScan on May 1, 2026.

Overview

The skill coherently implements one-shot reminders using OpenClaw cron; its channel/session use and short-lived persistence are disclosed and purpose-aligned.

Install this if you want your agent to schedule one-shot reminders through OpenClaw. Before use, confirm the default channel, delivery target, and timezone, and be cautious with sensitive reminder text in shared channels.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

A reminder request can result in a future message being posted through your OpenClaw instance.

Why it was flagged

The skill schedules future OpenClaw announcements. This is the core reminder function and is disclosed, but it still gives the agent authority to create scheduled messages.

Skill content

CMD=("$OPENCLAW" cron add ... --message "${EMOJI} ${MSG}" --announce ... --delete-after-run --json)

Recommendation

Use it for intended reminders only, and list or cancel active reminders if one is set incorrectly.

Low

#ASI03: Identity and Privilege Abuse

What this means

Reminders may be routed using the current chat/session target, including configured or derived channel identifiers.

Why it was flagged

The script uses OpenClaw delivery/session metadata to determine where to send the reminder. This is expected for channel auto-detection, but those identifiers control the delivery destination.

Skill content

local env_to="${OPENCLAW_TO:-}" ... local session_key="${OPENCLAW_SESSION_KEY:-}" ... print(f"qqbot:c2c:{uid}")

Recommendation

Verify the configured channel and target before relying on reminders, especially for shared or public chats.

Low

#ASI06: Memory and Context Poisoning

What this means

Reminder contents can persist until the reminder fires or is cancelled.

Why it was flagged

The user's reminder text is stored in the OpenClaw cron job for later delivery. This is necessary for reminders, but the text may contain personal information.

Skill content

--description "${MSG}" --message "${EMOJI} ${MSG}"

Recommendation

Avoid putting highly sensitive information in reminders unless you are comfortable with it being stored by the local OpenClaw cron system until delivery.