Security audit

Reminder

Security checks for vulnerabilities and agentic risk

Overview

This reminder skill is disclosed, but it schedules user-written reminder text as a privileged main-session system event that later posts results to Discord.

Review this before installing. It is not clearly malicious, but it can create scheduled main-session agent events from Discord-supplied text and send results back to Discord. Prefer a version that treats reminder text as quoted data, uses an isolated low-privilege execution context, and asks for confirmation before scheduling.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:65
Finding: User-Controlled Reminder Text Is Promoted to a Main-Session System Event
Content: View full analysis
`, `<` - Double quotes: `"` (breaks CLI quoting) - Newlines: `\n` (can inject multiple commands) - Dangerous command prefixes: `sudo`, `rm`, `wget`, `curl`, `bash`, etc. 2. **Sanitization Script**: Use `scripts/sanitize-message.sh` to validate input: ```bash ./scripts/sanitize-message.sh "user's task content" # Exit code 0 = safe, non-zero = rejected ``` 3. **If rejected**: Tell user the task contains invalid characters and ask them to rephrase without: $() ` ; | & > < " or dangerous commands. ``` The validator only detects shell syntax and a limited set of command prefixes: ```bash sanitize_message() { local input="$1" # Check for command substitution pa ...[truncated 4359 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill invokes shell commands such as session_status, date, and openclaw cron add, but it does not declare restrictive tool scope like permissions or allowed-tools. That creates an authorization gap where the runtime may permit broader command execution than the skill actually needs, which is especially risky because the skill also handles user-derived input and schedules deferred execution.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 91% confidence
Finding: The skill creates a persistent cron job that executes later in the main session using --system-event, inheriting Discord delivery context and sending results back automatically. Deferred execution is inherently more dangerous here because it separates the action from the original request, can outlive the immediate user interaction, and may be abused for persistence, delayed spam, or replaying unsafe content if validation is bypassed or incomplete.
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
## Usage When user says "remind me to XXX in 30 seconds" or "remind me at 3pm", I create a cron job that executes the task and returns the result when the time comes. ## Parameter Configuration

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger condition is broad enough that the skill may activate on loosely related natural-language requests like 'remind me' without strong confirmation of scheduling intent, target content, or execution constraints. In a skill that creates persistent cron jobs and later emits messages into Discord, ambiguous activation increases the chance of unintended task creation, spam, or abuse through social-engineered phrasing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The example system event uses "Check Beijing weather," which bakes in a specific location/locale choice rather than reflecting a user-selected preference. While only an example, it is natural-language guidance that could steer behavior toward a locale assumption without explicit user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.