Security audit

macOS Reminders

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real macOS Reminders helper, but it needs review because it can read and create reminders while retaining reminder titles and list names in local logs with weak privacy controls.

Install only if you are comfortable letting the skill read and create Apple Reminders and keep a local plaintext action log containing reminder titles and list names. Review or disable logging, tighten file permissions, and require confirmation for ambiguous write requests before using it with sensitive personal, work, health, or financial reminders.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Note

Location: scripts/reminders.sh:61
Finding: Reminder Content Exposed Through Child Process Environment Variables
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/reminders.sh:22
Finding: Sensitive Plaintext Logging Without Enforced File Permissions or Symlink Protection
Content: View full analysis
> "$LOGFILE" } ``` Reminder creation logs the list name and reminder title: ```bash log_action "create-reminder" "$list_name" "$name" ``` ### Technical Analysis The action log persistently stores reminder titles and list names in plaintext. These values may reveal medical appointments, work activities, travel plans, personal contacts, or other private information. The script does not set a restrictive `umask` or explicitly assign permissions to the log directory and file. Consequently, their permissions depend on the invoking process's existing umask and the permissions of pre-existing filesystem objects. Under a permissive configuration, other local users may be able to read the log. The append operation also follows symbolic links. If an attacker can create or replace the configured log path before execution, the attacker may point `logs/reminders.log` at another file writable by the victim. Each logged action would then append attacker-influenced reminder metadata and fixed formatting to that target. This is not unrestricted file writing, but it can corrupt or inject lines into files writable by the executing account. ### Attack Path #### Plaintext disclosure 1. The skill runs under an account with a permissive umask or uses a pre-existing log file with broad read permissions. 2. A user creates reminders containing private titles or assigns them to sensitive list names. 3. The script appends the title and list name to `logs/reminders.log`. 4. Another local account with read access opens ...[truncated 1145 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill invokes shell commands and relies on environment-derived paths like $SKILL_DIR, but it does not declare any explicit tool scope or allowed-tools boundary. That weakens least-privilege controls and makes accidental or unauthorized command execution harder to govern, especially for a skill that creates and queries user data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger language is broad enough to match ordinary conversational phrases like 'make a task' or 'flag this as important,' which can cause the skill to activate when the user did not intend to modify Reminders. In this context, mistaken activation directly creates or changes data in the user's Apple Reminders account, making the overbroad scope materially risky.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill documentation explains how to create and manage reminders but does not clearly warn that it will create, modify, and potentially expose user task data in their Apple Reminders account. Missing this notice increases the chance of unintended writes and weak informed consent for an action-oriented skill operating on personal productivity data.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Line L134 states that all actions are logged to logs/reminders.log with specific fields, presenting this as an implemented behavior. In this file, there is no corresponding implementation—only command examples and operational guidance—so the documentation actively overstates what the file itself does.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction to log reminder actions with fields including list and name implies storing potentially sensitive user task content in plain-language logs. Reminder titles and notes often contain personal, health, financial, or work information, so routine logging creates unnecessary retention and disclosure risk if the log file is readable, backed up, or exfiltrated.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script persistently logs reminder metadata, including reminder names and list names, to a local file without disclosing that behavior in the skill description. Reminder titles and list names often contain sensitive personal information, so this creates an unnecessary data-retention channel and increases privacy risk if local files are later accessed by other users, processes, backups, or support tooling.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: Before handling any command, the script checks for the Reminders process and opens the Reminders.app GUI if it is not running. While interacting with Reminders is in scope, forcibly launching the desktop app is an extra user-visible capability beyond simple reminder creation/listing and is not disclosed in the manifest.
Content: No source excerpt is available for this finding.