Security audit
Security checks for vulnerabilities and agentic risk
This reminder skill is purpose-aligned and discloses local persistence, but the package only contains documentation and no executable reminder script.
Before installing, treat reminder messages and schedules as locally persisted data in ~/.openclaw/reminders.json, avoid storing highly sensitive details on shared or backed-up machines, and verify any separate reminder.py implementation before running the documented commands because it is not included in this package.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## When to Use
- User wants to set a reminder
- Schedule recurring tasks
- Manage to-do lists
- Send timed notifications
The skill explicitly states that reminders are persisted to a local file, but it does not warn users that reminder contents may include sensitive personal or business information and will remain on disk across restarts. This creates a real privacy risk on shared, backed-up, or compromised systems because reminder text and schedules can be recovered later.
No suspicious patterns detected.