Remindy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:09 AM UTC
• Version: 1.0.0

Overview

This reminder skill is purpose-aligned, but its API contract exposes user-scoped reminder and push-notification actions without documented authentication or authorization controls.

Review this carefully before installing. It appears to be a normal remote reminder API, but the published contract does not document how users are authenticated or how one user's reminders and push subscriptions are protected from another caller. Do not use it for sensitive schedules, private task details, or real user notification subscriptions unless the publisher can confirm proper authentication, ownership checks, and deletion behavior.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: openapi.json:10

Finding

Unauthenticated User-Scoped Operations Permit Potential IDOR

Content

View full analysis

Vulnerability Details

File Location: openapi.json:10-239, with affected request schemas at openapi.json:289-401; corresponding usage documentation at SKILL.md:93-199
Vulnerability Type: Missing authentication and object-level authorization for user-scoped API operations
Risk Level: High

The API contract exposes reminder and push-subscription operations that accept a caller-controlled numeric userId. No authentication scheme, operation-level security requirement, or mechanism binding that identifier to an authenticated principal is declared.

A representative affected operation is:

json

"/api/reminders/list": {
  "post": {
    "summary": "List Reminders",
    "operationId": "list_reminders_api_reminders_list_post",
    "requestBody": {
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/ReminderListRequest"
          }
        }
      },
      "required": true
    },
    "responses": {
      "200": {
        "description": "Successful Response",
        "content": {
          "application/json": {
            "schema": {}
          }
        }
      },
      "422": {
        "description": "Validation Error",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/HTTPValidationError"
            }
          }
        }
      }
    }
  }
}

The referenced request model allows the caller to select the user:

json

"ReminderListRequest": {
  "properties": {
    "userId": {
      "type": "integer",
      "title": "Userid"
    }
  },
  "type": "object",
  "required": [
    "userId"
  ],
  "title": "ReminderListRequest"
}

The same design is used by /api/push/status, /api/push/unsubscribe, /api/reminders/delete, and /api/push/subscribe. The OpenAPI document contains no components.securitySchemes definition and no global or operation-level security declaration.

Technical Analysis

This desi ...[truncated 3136 chars]

Remediation

View remediation

Remediation Suggestions

1. Require authentication for every user-scoped reminder and push endpoint.
2. Define the authentication mechanism in components.securitySchemes, such as OAuth 2.0 or validated bearer tokens, and apply it globally or to every protected operation.
3. Derive the user identity exclusively from the validated session or access token. Do not trust a client-supplied userId as the authorization identity.
4. Remove userId from ordinary request bodies where possible. If administrative workflows require it, protect them with separate privileged scopes and explicit authorization checks.
5. Enforce object-level authorization for every reminder operation by verifying that the requested reminderId belongs to the authenticated principal.
6. For push subscription updates and deletion, verify that the authenticated principal owns the subscription being modified.
7. Prevent silent replacement of existing push subscriptions without authenticated confirmation and appropriate auditing.
8. Return generic authorization failures that do not reveal whether another user's resource exists.
9. Apply rate limiting and anomaly detection to reduce identifier enumeration.
10. Prefer non-sequential, high-entropy public identifiers as defense in depth, while retaining mandatory authorization checks.
11. Add automated negative tests proving that one authenticated user cannot list, delete, inspect, unsubscribe, or replace another user's resources.
12. Document all authorization requirements and expected 401 Unauthorized and 403 Forbidden responses in the OpenAPI specification.
13. Minimize response data from push-status operations; avoid returning endpoint details unless they are strictly required by an authenticated client.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

md

## References

- **Kong Route:** https://api.toolweb.in/tools/remindy
- **API Docs:** https://api.toolweb.in:8198/docs

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This manifest-style OpenAPI file describes a create-reminder operation that accepts reminder title, description, scheduled time, timezone, channel, and optional email address, while the API title/description also states that email and browser push notifications are sent. The spec does not include any warning or disclosure about transmitting/storing this user data or sending notifications on the user's behalf.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file documents a POST /api/reminders/delete endpoint that removes reminders, but it does not include any warning that the operation deletes user data or that the action may be irreversible. For markdown files, SQP-2 applies when behaviour affecting user data or system integrity is described without an accompanying warning.

Content

No source excerpt is available for this finding.