Security audit

remi

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for managing Apple Reminders, but it should be reviewed because it can run an unpinned third-party CLI and perform cloud-synced deletions without a clear agent-level confirmation requirement.

Review this skill before installing. Prefer a preinstalled or pinned, trusted `remi` binary instead of allowing runtime `npx` downloads, and require explicit confirmation with the exact list/reminder identifier before any delete operation because changes may sync through iCloud.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:4
Finding: Unpinned Third-Party Package May Be Downloaded and Executed
Content: View full analysis
Remediation: View remediation
`, rather than resolving the latest available release. 2. Install the package through an explicit, controlled setup process instead of permitting implicit runtime downloads through `npx`. 3. Use a lockfile and registry-provided integrity hashes where supported. 4. Configure `npx` to avoid silently installing missing packages, or verify that the expected executable is already installed before invocation. 5. Pin the Homebrew formula or release where practical and document the trusted upstream repository. 6. Verify package provenance, signatures, checksums, maintainers, and release artifacts before updating. 7. Run the CLI with least privilege and restrict its filesystem, network, and macOS privacy permissions to those required for reminder management. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:12
Finding: Programmatic JSON Mode Bypasses Deletion Confirmation
Content: View full analysis
" --confirm ``` ```bash # Reminders remi delete "" "" --confirm ``` ```markdown - **Title matching** — case-insensitive; use `--id <prefix>` if ambiguous - **Sections sync to iCloud** — changes appear on all Apple devices - **`--confirm` required** for delete operations in interactive mode (not needed with `--json`) ``` ### Technical Analysis The Skill requires `--json` for programmatic use while explicitly stating that deletion confirmation is unnecessary in JSON mode. This removes the CLI's interactive safeguard precisely in the mode an agent is expected to use. The risk is increased by title-based, case-insensitive matching. Although the documentation recommends an ID prefix when a title is ambiguous, it does not require unique target resolution or explicit user approval before deletion. The documented behavior also indicates that changes synchronize through iCloud, allowing an incorrect local action to propagate to other Apple devices. This is a safety weakness rather than evidence of intentional malicious behavior. Exploitation or accidental activation requires the agent to issue a destructive command based on an ambiguous, misunderstood, or untrusted request. ### Attack Path 1. A user request is ambiguous, or untrusted content causes the agent to infer that a reminder or list should be deleted. 2. The agent resolves the target by its case-insensitive title without first requiring a unique identifier. 3. The agent follows the instruction to use programmatic JSON mode. 4. JSON mode bypasses the CLI's interactive deleti ...[truncated 712 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The skill instructs the agent to run an unpinned package via npx @mattheworiordan/remi, which fetches and executes whatever version is current at runtime. This creates a supply-chain risk: a compromised publisher account, malicious new release, or dependency hijack could cause arbitrary code execution in the agent environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill documents destructive deletion commands and notes that --confirm is not needed with --json, but it does not clearly warn that programmatic/non-interactive use can bypass an explicit safety confirmation. In an agent context, that makes unintended or overbroad deletions more likely, especially because reminder and list changes sync through iCloud across devices.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description says to use the skill whenever the user asks to create, list, complete, search, or organize reminders, but it does not define exclusions or constraints on when this skill should be chosen instead of general task management behavior. This is broad enough to overlap with ordinary conversation about reminders and lacks negative examples or narrower trigger scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.