remi

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:52 AM UTC
• Version: 0.1.0

Overview

This skill is coherent for managing Apple Reminders, but it should be reviewed because it can run an unpinned third-party CLI and perform cloud-synced deletions without a clear agent-level confirmation requirement.

Review this skill before installing. Prefer a preinstalled or pinned, trusted `remi` binary instead of allowing runtime `npx` downloads, and require explicit confirmation with the exact list/reminder identifier before any delete operation because changes may sync through iCloud.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4
• Finding: Unpinned Third-Party Package May Be Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 4–12 **Vulnerability Type**: Unpinned third-party dependency and runtime package retrieval **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw": {"requires": {"bins": ["remi"]}, "install": {"brew": "mattheworiordan/tap/remi", "node": "@mattheworiordan/remi"}}} ``` ```markdown ## How to invoke Run `remi` as a CLI command via Bash. If `remi` is not on PATH, use `npx @mattheworiordan/remi` instead. Always use `--json` when calling programmatically. ``` ### Technical Analysis The Skill instructs the agent to execute the unpinned npm package `@mattheworiordan/remi` through `npx` when a local `remi` executable is unavailable. Because no exact version or integrity hash is specified, `npx` may retrieve and execute the package version currently served by the package registry. The effective executable can therefore change after the Skill has been reviewed. The declared Homebrew installation source, `mattheworiordan/tap/remi`, is likewise a third-party tap without a documented version or integrity constraint. This creates a supply-chain trust dependency on the package publisher, registry, Homebrew tap, and associated accounts and infrastructure. There is no evidence in the reviewed file that the named package is currently malicious. The risk arises from mutable and unverified third-party code being authorized for local execution. ### Attack Path 1. An attacker compromises the npm publisher account, registry distribution path, package repository, or third-party Homebrew tap. 2. The attacker publishes a modified package or formula containing malicious installation or runtime behavior. 3. The agent attempts to use this Skill on a system where `remi` is not already available on `PATH`. 4. Following the Skill instructions, the agent runs `npx @mattheworiordan/remi`. 5. `npx` downloads and executes the registry-provided package without enforcing a reviewed version or integrity v ...[truncated 694 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the npm dependency to an exact reviewed version, such as `@mattheworiordan/remi@<reviewed-version>`, rather than resolving the latest available release. 2. Install the package through an explicit, controlled setup process instead of permitting implicit runtime downloads through `npx`. 3. Use a lockfile and registry-provided integrity hashes where supported. 4. Configure `npx` to avoid silently installing missing packages, or verify that the expected executable is already installed before invocation. 5. Pin the Homebrew formula or release where practical and document the trusted upstream repository. 6. Verify package provenance, signatures, checksums, maintainers, and release artifacts before updating. 7. Run the CLI with least privilege and restrict its filesystem, network, and macOS privacy permissions to those required for reminder management. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:12
• Finding: Programmatic JSON Mode Bypasses Deletion Confirmation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 12–57 **Vulnerability Type**: Missing safety control for destructive, cloud-synchronized operations **Risk Level**: Low ### Vulnerable Code ```markdown Run `remi` as a CLI command via Bash. If `remi` is not on PATH, use `npx @mattheworiordan/remi` instead. Always use `--json` when calling programmatically. ``` ```bash # Lists remi delete-list "<name>" --confirm ``` ```bash # Reminders remi delete "<list>" "<title>" --confirm ``` ```markdown - **Title matching** — case-insensitive; use `--id <prefix>` if ambiguous - **Sections sync to iCloud** — changes appear on all Apple devices - **`--confirm` required** for delete operations in interactive mode (not needed with `--json`) ``` ### Technical Analysis The Skill requires `--json` for programmatic use while explicitly stating that deletion confirmation is unnecessary in JSON mode. This removes the CLI's interactive safeguard precisely in the mode an agent is expected to use. The risk is increased by title-based, case-insensitive matching. Although the documentation recommends an ID prefix when a title is ambiguous, it does not require unique target resolution or explicit user approval before deletion. The documented behavior also indicates that changes synchronize through iCloud, allowing an incorrect local action to propagate to other Apple devices. This is a safety weakness rather than evidence of intentional malicious behavior. Exploitation or accidental activation requires the agent to issue a destructive command based on an ambiguous, misunderstood, or untrusted request. ### Attack Path 1. A user request is ambiguous, or untrusted content causes the agent to infer that a reminder or list should be deleted. 2. The agent resolves the target by its case-insensitive title without first requiring a unique identifier. 3. The agent follows the instruction to use programmatic JSON mode. 4. JSON mode bypasses the CLI's interactive deleti ...[truncated 712 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user approval immediately before every reminder, section, or list deletion, regardless of whether JSON mode is used. 2. Present the exact target—including list name, reminder title, and stable identifier—before requesting approval. 3. Resolve destructive targets to a unique full identifier rather than relying on case-insensitive title matching or a potentially ambiguous prefix. 4. Reject deletion when multiple objects match and ask the user to disambiguate. 5. Preserve `--confirm` for destructive commands wherever the CLI supports it, even if JSON mode does not technically require the flag. 6. Consider implementing a two-step workflow: first retrieve and display the target in JSON, then execute deletion only after a separate confirmation. 7. Prefer reversible completion or archival actions over deletion when those actions satisfy the request. 8. Document iCloud synchronization explicitly in the confirmation prompt so the user understands that the effect may propagate to other devices. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The skill instructs the agent to run an unpinned package via `npx @mattheworiordan/remi`, which fetches and executes whatever version is current at runtime. This creates a supply-chain risk: a compromised publisher account, malicious new release, or dependency hijack could cause arbitrary code execution in the agent environment.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill documents destructive deletion commands and notes that `--confirm` is not needed with `--json`, but it does not clearly warn that programmatic/non-interactive use can bypass an explicit safety confirmation. In an agent context, that makes unintended or overbroad deletions more likely, especially because reminder and list changes sync through iCloud across devices.

Vague Triggers

Low

• Confidence: 92% confidence
• Finding: The manifest description says to use the skill whenever the user asks to create, list, complete, search, or organize reminders, but it does not define exclusions or constraints on when this skill should be chosen instead of general task management behavior. This is broad enough to overlap with ordinary conversation about reminders and lacks negative examples or narrower trigger scope.

Static analysis

No suspicious patterns detected.