MH apple-reminders

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: mh-apple-reminders Version: 1.0.0 The skill bundle is benign. It provides a wrapper for the `remindctl` CLI tool to manage Apple Reminders. The `SKILL.md` file clearly defines the skill's purpose, installation via Homebrew, and usage examples. Crucially, it includes explicit instructions for the AI agent on when to use and, more importantly, when *not* to use the skill (e.g., for Clawdbot alerts, directing the agent to use the `cron` tool instead). There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or deceptive prompt injection attempts. All commands shown are local executions of `remindctl`.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A mistaken or ambiguous deletion command could remove reminders or lists from the user's Reminders app.

Why it was flagged

The skill documents commands that can delete reminder lists or individual reminders. This is aligned with the stated purpose, but destructive operations should be user-directed.

Skill content
remindctl list Work --delete        # Delete list
remindctl delete 4A83 --force  # Delete by ID
Recommendation

Use explicit list names or reminder IDs, and confirm before deleting or completing reminders.

What this means

Once authorized, the CLI can read and modify Apple Reminders data available to the local macOS account.

Why it was flagged

The skill requires the remindctl CLI to receive macOS Reminders permission, which allows access to the user's local Apple Reminders data.

Skill content
macOS-only; grant Reminders permission when prompted
Recommendation

Grant Reminders permission only if you trust the installed remindctl CLI and want the agent to manage that data.

What this means

The security of the skill depends on the external remindctl package installed through Homebrew.

Why it was flagged

The skill depends on an external Homebrew tap rather than bundled reviewed code. This is normal for a CLI wrapper, but it means the installed binary's provenance matters.

Skill content
brew | formula: steipete/tap/remindctl | creates binaries: remindctl
Recommendation

Review or trust the remindctl project and Homebrew tap before installing, especially before granting Reminders permission.