ClawHub
Back to skill

Security audit

Arya Reminders

Security checks across malware telemetry and agentic risk

Overview

This reminder skill is functional, but it can send reminder text to a hardcoded Telegram chat that the main documentation says does not exist.

Review before installing. Use this only if you control and verify the Telegram chat destination, set ARYA_TELEGRAM_CHAT_ID to your own chat ID, and are comfortable with reminder contents being stored locally and scheduled into future cron jobs. Avoid sensitive reminder text unless the external delivery path is clearly configured.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The skill metadata and documentation claim a limited reminder workflow using cron plus markdown logging, but the finding indicates the implementation also sends reminders via Telegram and uses an embedded default chat ID. That creates an undeclared outbound data flow and potential hardcoded recipient issue, which can leak user reminder content to an unintended party while misleading users and reviewers about actual behavior.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The skill explicitly instructs the agent to log reminder metadata to `memory/reminders.md` without indicating any notice, consent, retention limit, or sensitivity checks. Even if the data seems operational, reminders can contain personal schedules, locations, health information, or other sensitive content, so silent persistence creates a privacy risk and expands the exposure surface.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script forwards reminder content and a chat destination into a Telegram delivery flow by default, using a hardcoded ARYA_TELEGRAM_CHAT_ID fallback and generating a cron request that will later send the message externally. Because the reminder text may contain sensitive user data and the script provides no explicit consent prompt, destination disclosure, or verification that the configured chat belongs to the requesting user, this creates a real confidentiality risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.