Security audit

Quick Reminder

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple reminder helper that sends scheduled reminders back through Telegram or the console, with no evidence of hidden data theft or destructive behavior.

Install only if you are comfortable with the skill watching incoming messages for reminder phrases and sending the reminder text back to the same Telegram context or console. Avoid putting secrets, private account details, or highly sensitive content in reminders, especially in shared chats or terminals.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The primary behavior matches the description well: it detects the specified natural-language reminder formats and schedules a reminder delivered either through Telegram or console. However, there is a mild description/behavior mismatch because the declared permissions are empty while the implementation sends Telegram messages through context.telegram, which is an external messaging capability/resource. Additionally, fs is imported, though unused, suggesting file-system access capability not reflected in the description; since it is unused, this is minor. Overall purpose is aligned, but undeclared resource usage makes this a mismatch under the stated criteria.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README says the skill converts 'frases normales' and 'detecta frases entrenadas de recordatorio' in Spanish and basic English, but it does not define a precise trigger set or exclusion conditions. This ambiguity could cause unintended invocation because common everyday reminder-like phrases may overlap with normal conversation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill advertises broad natural-language triggers without defining clear activation boundaries, which can cause accidental invocation from ordinary conversation. In an agent environment, that can lead to unintended reminder creation and unintended downstream actions such as sending notifications through integrated channels.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description says reminder content may be delivered automatically to Telegram, console, web, or other channels, but it does not clearly warn users that their message content will be retransmitted. That creates a privacy risk because sensitive reminder text could be exposed in logs, chats, shared terminals, or the wrong destination if users do not understand the forwarding behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file comments and user-facing reply strings indicate the skill operates primarily in Spanish, while only one trigger regex supports basic English input. This creates a language-policy concern because users are not offered a language choice, yet responses such as scheduling confirmations are always returned in Spanish.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.