Security audit

Arya Reminders

Security checks across malware telemetry and agentic risk

Overview

This reminder skill does what it says in part, but it can send reminder text to a hardcoded Telegram chat while the main docs say it uses no external APIs or outside IDs.

Review before installing. Only use this skill if Telegram delivery to chat ID 5028608085 is intended for you, or configure ARYA_TELEGRAM_CHAT_ID to your own verified chat before creating reminders. Avoid sensitive reminder text unless you are comfortable with it being stored in memory/reminders.md and delivered through Telegram.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented purpose says the skill creates reminder cron jobs and logs them locally, but the finding indicates additional behavior that sends reminder content to Telegram using a configurable or embedded default chat ID. Undisclosed outbound messaging and a hardcoded recipient materially change the data-flow and trust model, creating a risk of silent exfiltration of user reminder content and delivery to the wrong party.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script's stated purpose is creating reminders and logging them, but it also constructs a Telegram-directed delivery request. That hidden outbound messaging behavior expands the skill's capabilities beyond user-visible expectations and could send reminder content to an external destination without explicit confirmation.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The script uses Telegram chat targeting as part of reminder scheduling, but that destination behavior is not clearly justified by the described reminder-and-logging function. In a security review, undocumented external message routing is risky because user-provided message content may be transmitted off-tool to a chat recipient the user did not intend.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill persists reminder contents to a local markdown file without prominently warning users in the description. Reminder text often contains sensitive personal, financial, health, or schedule information, so undisclosed retention can lead to privacy exposure for anyone with access to the workspace or backups.

Missing User Warnings

Low

Confidence: 95% confidence
Finding: The skill instructs the agent to write reminder details to a local markdown memory file without any user notice or consent. Even if intended for convenience, this creates an undisclosed persistence channel for potentially sensitive user content, which can expose personal schedules, tasks, or message text to later users, operators, or other components with filesystem access.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The skill hard-codes America/Bogota as the default timezone, which can cause reminders to be scheduled at the wrong real-world time for users in other locales. In a reminder automation context, silent timezone assumptions directly affect execution timing and can lead to missed deadlines, unwanted actions, or messages being delivered at incorrect times.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: A hardcoded fallback chat ID means that if the environment variable is absent or misconfigured, reminder contents will still be scheduled for delivery to a fixed external Telegram recipient. This creates a concrete risk of unintended data exfiltration, especially because reminder messages can contain sensitive personal or operational information.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.