ClawHub
Back to skill

Security audit

reminder

Security checks for vulnerabilities and agentic risk

Overview

This reminder skill is mostly coherent, but it can send personal schedule text to an external LLM and create persistent cron notifications without clear opt-in or confirmation.

Review this skill before installing if your reminders may contain private personal or work information. Use it only if you are comfortable sending reminder text to SkillBoss's API for parsing, and prefer confirming the resolved event and reminder times before it writes files or creates cron jobs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Warning
Location
SKILL.md:57
Finding

Raw Personal Reminder Data Is Transmitted to an External LLM Service

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:73
Finding

Unvalidated LLM Output Is Used in a File-Writing and Cron-Scheduling Workflow

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation description is broad enough that the skill may trigger on ordinary planning or scheduling conversation and then begin capturing and storing event data. In this skill's context, over-triggering is risky because it can cause unintended persistence of personal schedule information and downstream transmission/scheduling actions without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends user-provided reminder text to an external API for LLM parsing, but the description does not clearly warn the user that potentially sensitive personal schedule content will leave the local environment. Because reminder content commonly includes meetings, birthdays, deadlines, and other private metadata, the lack of disclosure and consent materially increases privacy and data-handling risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The outbound request includes bearer-authenticated communication with a third-party endpoint while embedding user message content in the request body. Even if the API key itself is not exposed here, the design enables routine export of private reminder data to an external processor, creating confidentiality and compliance concerns.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

def parse_event_with_llm(user_input: str) -> dict:
    r = requests.post(
        "https://api.skillbossai.com/v1/pilot",
        headers={
            "Authorization": f"Bearer {SKILLBOSS_API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The outbound request includes bearer-authenticated communication with a third-party endpoint while embedding user message content in the request body. Even if the API key itself is not exposed here, the design enables routine export of private reminder data to an external processor, creating confidentiality and compliance concerns.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

def parse_event_with_llm(user_input: str) -> dict:
    r = requests.post(
        "https://api.skillbossai.com/v1/pilot",
        headers={
            "Authorization": f"Bearer {SKILLBOSS_API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The hardcoded external endpoint indicates that event parsing depends on sending user content off-device to a remote service. Since this skill is designed to process personal reminders, the endpoint usage directly affects sensitive calendar-like data and elevates privacy risk if users are not informed or if the provider's handling is unknown.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
def parse_event_with_llm(user_input: str) -> dict:
    r = requests.post(
        "https://api.skillbossai.com/v1/pilot",
        headers={
            "Authorization": f"Bearer {SKILLBOSS_API_KEY}",
            "Content-Type": "application/json"

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The comment states a default timezone of Asia/Shanghai, which imposes a specific locale-related setting if the environment variable is not provided. This is a natural-language locale policy concern because the file does not indicate user choice, opt-in, or region-specific justification for that default.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.