Donotify Voice Call Reminder

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:38 PM UTC
• Version: 1.0.1

Overview

The skill does what it claims, but it can place real phone calls and send reminder text plus a bearer token to a configurable API origin without enough scoping or confirmation guidance.

Review this skill before installing. Use only a trusted DoNotify API URL, prefer the official HTTPS service URL, and use a narrowly scoped revocable token. Be aware that reminder titles and descriptions are sent to DoNotify and may be spoken aloud in a phone call; confirm call requests carefully, especially immediate calls.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:9

Finding

Configurable API Origin Can Disclose Bearer Token and Reminder Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-22
Vulnerability Type: Unrestricted credential-bearing outbound requests
Risk Level: Medium

Vulnerable Code

yaml

requires:
  env:
    - DONOTIFY_API_TOKEN
    - DONOTIFY_URL
metadata: {"openclaw":{"requires":{"env":["DONOTIFY_API_TOKEN","DONOTIFY_URL"]},"primaryEnv":"DONOTIFY_API_TOKEN"}}
---

# DoNotify Skill

You can send immediate voice call reminders or schedule future calls through the DoNotify API.

## Authentication

All requests require:
- Header: `Authorization: Bearer $DONOTIFY_API_TOKEN`
- Header: `Accept: application/json`
- Base URL: `$DONOTIFY_URL` (default: `https://donotifys.com`)

Technical Analysis

The Skill directs the Agent to attach DONOTIFY_API_TOKEN as a bearer token to requests whose origin is controlled by the DONOTIFY_URL environment variable. The instructions do not require validation that the configured URL uses HTTPS or belongs to the expected donotifys.com origin. They also do not prohibit cross-origin redirects while retaining the authorization header.

If an attacker can influence the environment configuration, or if an operator enters an untrusted URL, subsequent usage checks, immediate-call requests, and scheduled-reminder requests can be sent to an attacker-controlled server. Those requests can expose both the bearer token and user-supplied reminder titles or descriptions.

The package contains no executable implementation that independently enforces the documented default URL, so the statement that https://donotifys.com is the default does not mitigate unsafe values supplied through DONOTIFY_URL.

Attack Path

1. An attacker, compromised deployment process, or unsafe configuration sets DONOTIFY_URL to an attacker-controlled HTTP or HTTPS endpoint.
2. The user asks the Agent to check usage, place an immediate voice call, or schedule a reminder.
3. Following the Skill ins ...[truncated 1347 chars]

Remediation

View remediation

Remediation Suggestions

• Remove DONOTIFY_URL as a user-configurable value if alternate API origins are not operationally required, and use the fixed origin https://donotifys.com.
• If configurability is required, parse and validate the URL before sending any request:
  • Require the https scheme.
  • Allowlist the exact expected hostname or a narrowly defined set of trusted hosts.
  • Reject embedded credentials, fragments, unexpected ports, IP-literal destinations, and deceptive hostname suffixes.
  • Resolve and reject loopback, link-local, private, and other internal network destinations where appropriate.
• Disable automatic redirects for authenticated requests, or validate every redirect target and strip the Authorization header whenever the origin changes.
• Construct authentication headers only after destination validation; do not expose the token in logs, error messages, or response summaries.
• Document that reminder titles and descriptions are transmitted to an external service and minimize sensitive content.
• Use a narrowly scoped, revocable API token and rotate it immediately if an untrusted API URL may have received requests.
• Add tests confirming that insecure schemes, unapproved hosts, cross-origin redirects, and deceptive hostnames are rejected before credentials or reminder data are transmitted.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to send reminder content and trigger immediate or scheduled voice calls through an external service, but it does not require explicit user-facing confirmation that reminder text will be transmitted off-platform or that a phone call will be initiated. This can lead to unintended disclosure of sensitive reminder content and surprising real-world actions, especially for ambiguous prompts like "call me now about X".

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.