reminder research

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:41 PM UTC
• Version: 1.0.2

Overview

This skill openly aims to run Apple Reminder notes as agent tasks, but it gives broad automated authority without enough scoping, review, or safeguards.

Install only if you are comfortable with reminder notes triggering automated agent actions. Use a dedicated private reminder list, avoid shared/synced sources you do not fully control, disable unattended cron until you have reviewed behavior, and require confirmations for file edits, calendar/API writes, smart-home actions, and any external search involving personal reminder content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: process-reminders.sh:10

Finding

Untrusted Reminder Notes Are Executed as Unrestricted Agent Instructions

Content

View full analysis

Vulnerability Details

File Location: process-reminders.sh:10-20, process-reminders.sh:25-30, process-reminders.sh:39-46; corroborated by SKILL.md:82-89 and architecture.md:74-86
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Critical

Vulnerable code:

bash

# Rules (universal, no exceptions):
#   1. No notes? → SKIP
#   2. Notes start with 🤖? → SKIP (already processed)
#   3. Notes exist without 🤖? → EXECUTE (spawn agent)
#
# Agent can do ANYTHING:
#   - Use skills (i-ching, librarian, weather, etc.)
#   - Edit files (ROADMAP, calendar, etc.)
#   - Call APIs (GitHub, Home Assistant, etc.)
#   - Research (web search, book search, etc.)

set -e

# Get all incomplete reminders with notes (no 🤖)
ALL_REMINDERS=$(remindctl all --json 2>/dev/null)

NEEDS_PROCESSING=$(echo "$ALL_REMINDERS" | jq -c '[
  .[] |
  select(.isCompleted == false) |
  select(.notes != null and .notes != "") |
  select(.notes | startswith("🤖") | not)
]')

bash

# Output items for agent processing
echo "$NEEDS_PROCESSING" | jq -c '.[]' | while read -r item; do
  ID=$(echo "$item" | jq -r '.id')
  TITLE=$(echo "$item" | jq -r '.title')
  NOTES=$(echo "$item" | jq -r '.notes')

  echo "EXECUTE|$ID|$TITLE|$NOTES"
done

The documented agent capabilities in SKILL.md:82-89 include file operations, calendar changes, API operations, and automation:

markdown

Agent executes natural language commands:

✅ **Research** (web, books, skills)
✅ **File operations** (edit ROADMAP, create notes, git commits)
✅ **Calendar** (create events, recurring schedules)
✅ **APIs** (GitHub issues, Home Assistant, Jira)
✅ **Automation** (anything you can describe)

Technical Analysis

Apple Reminder notes cross a trust boundary and are converted directly into agent instructions. The only eligibility controls are that a reminder must be incomplete, its notes must ...[truncated 1973 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat reminder titles and notes strictly as untrusted data rather than authoritative agent instructions.
2. Replace unrestricted natural-language execution with a typed action schema containing a small allowlist of supported operations and validated parameters.
3. Require an authenticated, explicit trigger rather than considering every nonempty note executable.
4. Require interactive user confirmation before file modification, API writes, commits, calendar changes, smart-home actions, or external data transmission.
5. Reject instructions that request credentials, private memory, arbitrary shell execution, policy changes, or invocation of tools outside the allowlist.
6. Run the reminder processor in a least-privileged sandbox with separate, narrowly scoped credentials and restricted filesystem/network access.
7. Preserve and audit the reminder creator, source, requested action, confirmation decision, tool calls, and resulting changes.
8. Apply immutable system-level safety policies that reminder content cannot override.
9. For shared or synchronized lists, require creator authorization and cryptographic or account-level provenance before accepting a task.

T09 · Insecure Skill Coding Practices

Error

• Location: process-reminders.sh:39

Finding

Delimiter Injection Through Unescaped Reminder Fields

Content

View full analysis

Vulnerability Details

File Location: process-reminders.sh:39-46
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable code:

bash

# Output items for agent processing
echo "$NEEDS_PROCESSING" | jq -c '.[]' | while read -r item; do
  ID=$(echo "$item" | jq -r '.id')
  TITLE=$(echo "$item" | jq -r '.title')
  NOTES=$(echo "$item" | jq -r '.notes')

  echo "EXECUTE|$ID|$TITLE|$NOTES"
done

Technical Analysis

The script extracts attacker-influenced titles and notes from JSON and inserts them verbatim into a custom pipe-delimited, line-oriented protocol. It does not escape or reject pipe characters, newlines, carriage returns, terminal control characters, or strings resembling new EXECUTE records.

Although shell variable expansion is quoted and therefore does not directly produce shell command substitution in this script, the emitted protocol loses the structural guarantees of the original JSON. A downstream parser or language model can interpret injected delimiters and newlines as field boundaries or additional task records.

Attack Path

1. An attacker creates an eligible reminder with a title or note containing |, a newline, or text formatted as another EXECUTE|... record.
2. jq -r extracts the content without protocol-specific escaping.
3. echo writes the crafted content directly into the line-oriented output stream.
4. The injected delimiter or newline changes the apparent record structure.
5. A downstream consumer may process attacker-created fields or additional apparent tasks, misattribute instructions, or ignore the original provenance.

Impact Assessment

Successful exploitation can corrupt task boundaries, spoof reminder identifiers or titles, inject additional apparent instructions, and obscure which reminder supplied a command. When combined with the unrestricted agent execution design, protocol injection may cause unintended ...[truncated 248 chars]

Remediation

View remediation

Remediation Suggestions

1. Preserve JSON end-to-end instead of converting records into a delimiter-based text protocol.
2. Emit one validated JSON object per task, with fixed keys and explicit action metadata.
3. Require the downstream component to use a JSON parser rather than string splitting or natural-language parsing.
4. Validate field types, maximum lengths, Unicode policy, and permitted control characters before output.
5. If a text protocol is unavoidable, use a formally specified encoding such as length-prefixed fields or Base64 and decode it only as data.
6. Bind each task to its source reminder identifier and verify that identity before any side effect.
7. Add tests covering pipes, multiline notes, carriage returns, escape sequences, terminal controls, and fake EXECUTE records.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned Third-Party Homebrew Tap Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:39-41; repeated at SKILL.md:71-74
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code:

markdown

1. Install dependencies
   `brew install steipete/tap/remindctl jq`

The dependency instruction is repeated later:

markdown

- `remindctl`: `brew install steipete/tap/remindctl`
- `jq`: `brew install jq`

Technical Analysis

The installation instructions obtain remindctl from a third-party Homebrew tap without pinning a release, formula revision, source commit, checksum, or signature. The audited project contains no dependency lock or vendored formula that establishes the exact reviewed artifact.

Consequently, installation behavior depends on the state of the external tap at installation time. A compromised tap, maintainer account, formula, or upstream release could substitute code after this skill has been reviewed.

Attack Path

1. The third-party tap, its maintainer account, formula repository, or referenced release is compromised or changed.
2. A user follows the documented brew install steipete/tap/remindctl jq command.
3. Homebrew retrieves and installs the then-current formula and associated software.
4. Malicious installation logic or a substituted binary executes under the installing user's authority.
5. The scheduled reminder workflow later invokes the substituted remindctl binary, which has access to reminder data and the surrounding user environment.

Impact Assessment

A malicious dependency or installation formula could execute code with the privileges of the user performing installation. A substituted remindctl could read or alter Apple Reminders, falsify JSON supplied to the agent, inject tasks, or access other resources available to the process.

No evidence was found that the named tap is currently malicious. The confirmed weakness is the lack of an immutable, verifia ...[truncated 46 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin remindctl to a reviewed release and immutable source revision.
2. Document and verify the expected cryptographic checksum of downloaded artifacts.
3. Prefer signed releases and verify signatures against a documented maintainer identity.
4. Maintain a lock file or equivalent dependency manifest recording exact versions and hashes.
5. Review Homebrew formula changes before updating the pinned dependency.
6. Document a controlled update procedure with provenance and integrity verification.
7. Run the installed utility with only the permissions required to query and update intended reminders.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Ssd 1

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The architecture states that custom reminder notes are treated as instructions for the agent and followed via a multi-source workflow. This creates an instruction-injection path from untrusted reminder content into an autonomous agent that can use tools, edit files, call APIs, and invoke other skills, enabling arbitrary or unintended actions if a reminder is maliciously crafted or synced from another source.

Content

No source excerpt is available for this finding.

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The rules define any non-marked reminder note as executable agent input, collapsing the boundary between benign personal notes and privileged automation. In the stated skill context, that is dangerous because reminders can contain arbitrary natural language that downstream agents may interpret as instructions to use tools, modify files, or access services.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented rule says any reminder with notes and no 🤖 marker should be executed, while the skill metadata grants broad downstream capabilities such as file editing and API calls. Even though this file does not execute actions directly, it establishes an unsafe trust model where ordinary reminder text can trigger privileged automation without a user-facing warning.

Content

No source excerpt is available for this finding.

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The implementation automatically emits all qualifying reminder notes as execution directives, creating a direct pipeline from untrusted reminder content to downstream agent processing. Because the surrounding skill advertises broad capabilities, this makes the context more dangerous: a benign-looking note can become an instruction source for privileged actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly advertises that reminder content can trigger broad actions across files, calendars, APIs, and home automation, yet it does not place meaningful guardrails, confirmation requirements, or safety warnings around high-impact operations. Because reminders are treated as natural-language instructions and the agent can use arbitrary skills and tools, a benign-looking note could cause account changes, file modification, or real-world automation with little user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented 3AM cron-driven processing makes the system autonomously execute reminder notes without an interactive check, increasing the chance that stale, injected, mistaken, or ambiguously worded reminders trigger impactful actions. In this context, scheduled background execution is especially dangerous because the skill's own examples include creating issues, editing files, scheduling events, and home automation changes, all of which can affect external systems or the physical environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The architecture routes reminder titles and notes into web search and other research tools without documenting privacy controls, minimization, or consent. Because reminder contents may include sensitive personal tasks, shopping intentions, health, financial, or home-related data, sending them to external services can leak private information beyond the local reminders system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The architecture explicitly updates Apple Reminders notes automatically, but the document does not describe explicit user consent, preview, rollback, or safeguards against overwriting user-authored note content. In this skill context, the agent operates on personal task data and modifies it on a schedule, so unintended data loss, corruption, or surprise edits are a real integrity and trust risk.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The Gen 3 design normalizes increasing trust in note content, culminating in arbitrary instruction following. In this skill context, that is especially dangerous because reminders can be created or modified by external sync sources, other devices, shared lists, or accidental user input, turning ordinary note text into a control channel for privileged automation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The comments state universal execution rules such as 'Notes exist without 🤖? → EXECUTE (spawn agent)' and say the 'Agent can do ANYTHING.' In practice, the code merely selects reminders and echoes lines like 'EXECUTE|...'; there is no agent invocation or execution path. This is an active contradiction between documentation and code behavior, not just missing detail.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes a skill that processes reminders by invoking an agent executor that can use skills, edit files, and call APIs. This script, however, only filters Apple Reminders entries and prints EXECUTE records; it does not itself spawn an agent, edit files, or call APIs. That is a meaningful behavior mismatch between the claimed operational scope and the actual implemented behavior in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script extracts reminder notes and forwards them verbatim for downstream processing without any consent, confirmation, or trust boundary. In this skill context, notes are natural-language user content and are treated as automation input, which creates a prompt/command injection path if downstream consumers interpret them as instructions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The flowchart says reminders are skipped when notes contain "💎", but later sections and the manifest context describe "🤖" as the result-tracking signifier and trigger exclusion condition. This is an active documentation contradiction about the core processing trigger, which could cause the skill to process the wrong reminders if implemented per one source versus the other.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The skill instructions and output examples are written as fixed English operational behavior even though example reminder content includes Portuguese text, and no language-selection or locale opt-in is described. This can indicate a language policy issue where the skill defaults to one language without giving the user a choice.

Content

No source excerpt is available for this finding.