Apple Reminders (remindctl)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:13 AM UTC
• Version: 1.0.0

Overview

The skill appears intended to manage Apple Reminders, but it also allows persistent cross-system copying of selected reminder details into an undefined Open Brain store without separate confirmation.

Review before installing. Use it only if you are comfortable granting Reminders Automation access, installing remindctl from the named Homebrew tap, and having durable reminder-related details potentially copied into Open Brain. Sensitive reminders, especially health or location-related items, should require explicit confirmation before any secondary storage.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:104

Finding

Unpinned Third-Party Homebrew Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 104
Vulnerability Type: Supply-chain exposure through an unpinned third-party package source
Risk Level: Medium

Vulnerable Code Snippet:

markdown

- `remindctl` is installed via Homebrew: `brew install steipete/tap/remindctl`

Technical Analysis

The documented installation command retrieves remindctl from the third-party Homebrew tap steipete/tap. It does not specify an immutable package version, source commit, artifact checksum, or other integrity constraint.

Consequently, the code installed by this command may differ from the version reviewed when the Skill was published. If the tap, its maintainer account, release pipeline, or referenced artifacts are compromised, the formula could be changed to install attacker-controlled code.

This is a supply-chain weakness rather than evidence that the current remindctl package is malicious. The risk arises because the Skill depends on a mutable external source without documenting integrity verification.

Attack Path

1. An attacker compromises the third-party Homebrew tap, a maintainer account, its build infrastructure, or an artifact referenced by the formula.
2. The attacker modifies the formula or associated package so that installation or execution runs malicious code.
3. A user follows the documented brew install steipete/tap/remindctl instruction.
4. Homebrew retrieves and installs the modified dependency.
5. The malicious package executes with the installing user's local privileges.
6. If the modified CLI is subsequently granted macOS Reminders Automation access, it can misuse that authorization when invoked.

Impact Assessment

A compromised dependency could execute code with the privileges of the local user running Homebrew or remindctl. Potential scope includes access to files and services available to that user, manipulation or disclosure of reminder data after autho ...[truncated 311 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin remindctl to a reviewed release or immutable source commit rather than relying on the current tap state.
2. Publish the expected version, source repository, artifact digest, and checksum verification procedure.
3. Prefer signed release artifacts and verify signatures before installation.
4. Review the Homebrew formula and its complete dependency chain before recommending installation.
5. Document a controlled update process that requires security review before changing the approved version.
6. Run the CLI with only the macOS permissions required for Reminders access and avoid granting unrelated filesystem or automation permissions.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:16

Finding

Cross-System Persistent Write Beyond the Declared Reminders Scope

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: Unbounded access to an additional persistent data store
Risk Level: Medium

Vulnerable Code Snippet:

markdown

If an item belongs in two stores (e.g. "remind me to take Mounjaro every Wednesday" is both a recurring reminder AND a protocol fact worth knowing), create the reminder first, then capture a thought in Open Brain referencing the reminder by its ID prefix in the format `reminder:4A83`.

Technical Analysis

The Skill is declared as an Apple Reminders management capability, but this instruction directs the agent to perform an additional persistent write to an external system identified as “Open Brain.” The reviewed project does not define that system's interface, authorization boundary, retention policy, access controls, or permitted data fields.

The decision to duplicate data is based on the agent's assessment that an item is “durable context,” rather than explicit per-item user authorization. The example involves medication information, demonstrating that potentially sensitive personal or health-related context may be copied outside Apple Reminders.

This expands the Skill's effective permission and data-processing scope beyond the minimum required to create a reminder. The text limits mirroring to selected durable items, but it does not require confirmation before the external write or define controls preventing excessive content from being copied.

Attack Path

1. A user requests creation of a reminder containing personal, medical, location-related, or other sensitive context.
2. The agent interprets the reminder as durable information that belongs in two stores.
3. The agent creates the requested Apple Reminder.
4. Without separate per-item confirmation, the agent writes related content into “Open Brain.”
5. The duplicated information persists under a separate and unspecified authorization, access, and reten ...[truncated 813 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic mirroring to “Open Brain” unless it is essential to the documented purpose of the Skill.
2. Require explicit, informed user confirmation before every cross-system write.
3. Show the exact content and destination to the user before storing it.
4. Define the “Open Brain” interface, authorization model, retention period, deletion process, and access-control requirements.
5. Apply data minimization by copying only the minimum necessary fields; avoid medication, location, and other sensitive details by default.
6. Provide a configuration option that disables all cross-system persistence.
7. Record user consent and make mirrored records discoverable and removable.
8. Separate reminder creation from secondary persistence so failure or refusal of the latter does not affect the requested reminder operation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.