Security audit
Security checks for vulnerabilities and agentic risk
This is a simple reminder skill whose local state and notification behavior are disclosed and aligned with hydration and movement reminders.
Before installing, confirm that 8:00-23:00 GMT+8 is the reminder window you want, and be aware that the skill stores the last reminder time and chat/session ID in a local OpenClaw state file so it can send recurring reminders.
The skill hard-codes a GMT+8 timezone context for reminder timing without obtaining user preference. This can cause reminders to fire at unintended times, potentially disrupting the user or undermining trust in the agent's behavior, especially in cross-timezone environments.
The skill fixes working hours to 8:00-23:00 GMT+8 without documenting user choice or consent. In context this is a reminder skill, so the impact is limited, but rigid scheduling can still cause unwanted notifications during rest time for users in different schedules or regions.
The skill instructs the agent to create and update a local state file automatically, but it does not clearly warn the user that persistent local files will be modified. While this is not overtly malicious, silent persistence can surprise users, affect local state integrity, and normalize unattended filesystem writes by automation.
