ClawHub
Back to skill

Security audit

Apple Reminders

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Apple Reminders helper that uses a disclosed macOS CLI, with expected reminder-editing and deletion abilities but no hidden or unrelated behavior found.

Install only if you want Codex to manage Apple Reminders on your Mac and you trust the remindctl Homebrew tap. Confirm before running commands that edit, complete, rename, or delete reminders or lists, especially commands using --force.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill documents a forceful reminder deletion command (`remindctl delete 4A83 --force`) without any warning about irreversibility or the risk of deleting the wrong item. In an agent skill context, concise command examples are often reused verbatim, so presenting destructive operations without caution increases the chance of accidental user data loss.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill includes list deletion (`remindctl list Work --delete`) and rename/create management commands without any caution that deleting a list may remove associated reminders or otherwise destroy user-organized data. Because this skill is designed to manage real personal reminders, the lack of warnings makes accidental destructive use materially more dangerous.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.