Donotify Voice Call Reminder

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent DoNotify reminder integration, but it uses a DoNotify API token to place or schedule real phone calls, so users should keep requests explicit.

Before installing, confirm you trust the DoNotify service and token handling, set DONOTIFY_URL to the intended DoNotify domain, and avoid putting secrets or highly sensitive details in reminder titles or descriptions because they are sent to DoNotify and spoken aloud during calls.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

A user request can result in an actual phone call being placed and notification quota being used.

Why it was flagged

The skill directs the agent to trigger an external API call that places an immediate voice call. This is purpose-aligned, but it has a real-world side effect.

Skill content

When the user says "call me now about X" or "remind me right now about X", use the **Call Now** endpoint.

Recommendation

Use clear, explicit requests for calls and review the reminder title/description before asking the agent to send or schedule one.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone or any agent with access to the token could check usage and place or schedule DoNotify calls within the account’s limits.

Why it was flagged

The skill requires a DoNotify bearer token and sends it to the configured API base URL. This is expected for the integration, but it grants access to the user's DoNotify account functions.

Skill content

All requests require:
- Header: `Authorization: Bearer $DONOTIFY_API_TOKEN`
- Header: `Accept: application/json`
- Base URL: `$DONOTIFY_URL`

Recommendation

Store the token securely, use the least-privileged token available, and set DONOTIFY_URL only to the intended official DoNotify endpoint.

Note

ASI08: Cascading Failures

What this means

A misinterpreted reminder could create an unwanted future phone call.

Why it was flagged

The schedule endpoint creates future pending reminders. This is disclosed and central to the skill, but an incorrect interpreted time or title could persist until changed in DoNotify.

Skill content

POST $DONOTIFY_URL/api/reminders ... "call_at": "2025-06-15T14:45:00Z"

Recommendation

For scheduled calls, confirm the date, time, timezone, and reminder wording before relying on the reminder.