Security audit
Security checks for vulnerabilities and agentic risk
This is a simple reminder skill that clearly stores reminder data locally and schedules Telegram reminders, with no hidden code or unrelated behavior found.
Install this only if you are comfortable having reminder details saved in your OpenClaw workspace and used to create Telegram reminder jobs. Set REMINDER_TZ if you are not using Asia/Shanghai, and verify important reminder times after scheduling.
The invocation text is broad enough that ordinary conversation about meetings, plans, or schedules could trigger the skill without a clearly bounded user request. In this skill's context, that matters because activation can lead to persistence of personal event data in the workspace and scheduling outbound Telegram notifications, creating privacy and action-without-clear-intent risk.
The skill describes storing reminders in the workspace and sending Telegram notifications, but it does not clearly warn users that personal schedule data will be persisted and transmitted. That omission can cause users to disclose sensitive events, locations, birthdays, or deadlines without informed consent, increasing privacy and data-handling risk.
Defaulting to Asia/Shanghai and Chinese-oriented date interpretation without clear opt-in can silently misinterpret dates and times for users in other locales. In a reminder skill, that can cause reminders to fire at incorrect times or on incorrect dates, which is operationally harmful even if it is not a classic confidentiality breach.
The comment sets a default timezone of Asia/Shanghai via REMINDER_TZ, which imposes a specific locale choice if the environment variable is not provided. This can violate language/locale policy because the file does not indicate user opt-in or explain why this region-specific default is required.
