timely

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:52 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward wrapper for a macOS Reminders CLI, with a disclosed third-party Homebrew install that users should trust before granting Reminders access.

Before installing, verify that you trust the halbotley Homebrew tap and the timely CLI because it will run locally and can access your Reminders data after macOS permission is granted. Revoke Reminders access later if you no longer use it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Third-Party Homebrew Dependency from a Custom Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-15
Vulnerability Type: Unpinned third-party dependency from a custom Homebrew tap
Risk Level: Medium

Complete Code Snippet

yaml

requires:
  bins: ["timely"]
install:
  - id: brew
    kind: brew
    formula: halbotley/tap/timely
    bins: ["timely"]
    label: "Install timely (brew)"

The same installation source is presented directly to users at lines 31-32:

bash

brew tap halbotley/tap
brew install timely

Technical Analysis

The Skill installs and executes the timely binary from the third-party Homebrew tap halbotley/tap. The dependency is not pinned to a reviewed version or immutable revision, and the documentation provides no checksum, signature verification, source reference, or other integrity control.

Only SKILL.md is included in the project, so the source and installation behavior of timely cannot be audited from this artifact. The package fetched during installation may also change after the Skill itself has been reviewed. This creates a supply-chain trust boundary in which control of the tap, formula, release artifacts, or associated distribution infrastructure can determine what code users install.

This finding does not establish that the current timely package is malicious. It identifies the absence of controls needed to ensure that the installed binary remains identical to a reviewed artifact.

Attack Path

1. An attacker compromises the custom Homebrew tap, its maintainer account, formula repository, release infrastructure, or an artifact referenced by the formula.
2. The attacker modifies the formula or distributed package so that installation logic or the resulting timely executable contains malicious behavior.
3. A user follows the documented installation instructions or the Skill framework invokes the declared installer.
4. Homebrew downloads and executes installation logic from the attacker-influenced dependency source.
5. The ma ...[truncated 965 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin timely to a specific reviewed release and, where supported, an immutable source commit.
2. Verify downloaded artifacts with a cryptographic checksum or a trusted signature before installation.
3. Record the expected version, source repository, artifact digest, and verification procedure in SKILL.md.
4. Prefer an official, trusted distribution channel over a mutable custom tap when one is available.
5. Vendor the reviewed implementation into the project, or include auditable source code and reproducible build instructions.
6. Add automated checks that reject unexpected formula-source, version, or checksum changes.
7. Review the Homebrew formula for install-time scripts and transitive dependencies before approving updates.
8. Apply least privilege to Reminders authorization and document that users should revoke access if the binary's integrity cannot be verified.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.