Security audit

Smart Reminder Free

Security checks for vulnerabilities and agentic risk

Overview

This reminder skill mostly matches its stated purpose, but it includes under-scoped reminder delivery that can send event details to Telegram and a fixed recipient.

Review before installing. Use this only if you are comfortable with local storage of reminder data, and do not run the provided Telegram cron example until the recipient, channel, and consent flow are changed to your own controlled configuration. Avoid Git-syncing the events file unless you intend to store calendar details in that repository.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill markets itself as an event-understanding assistant, but the documentation also describes cron-based scheduling and Telegram delivery. This capability expansion matters because it changes the trust boundary from local parsing/storage to outbound notification behavior, which can expose user data or trigger actions the user did not expect.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Introducing Telegram bot token handling and external message delivery extends the skill into third-party data transmission without a clear need from the stated purpose. Even if tokens are not hardcoded, the skill encourages routing user reminder content through an external service, increasing risk of privacy leakage and misuse of notification channels.

Scope Creep

High

Confidence: 97% confidence
Finding: The manifest declares only read/exec tools, yet the skill documentation describes persistent writes to events.yml, cron scheduling, and Telegram/network-based delivery. This mismatch is dangerous because operators may approve the skill under a narrower permission model than its documented behavior actually requires, undermining security review and user consent.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The skill initially claims it is not about creating reminders, but later instructs agents to capture, store, schedule, and deliver reminders. This inconsistency can mislead reviewers and users about the operational impact of enabling the skill, making unexpected state changes or outbound actions more likely.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The example schedules reminders that will actively send outbound messages to Telegram and a fixed phone number, which exceeds the stated scope of a basic local reminder/storage skill. Even if intended as a demo, embedding unsolicited external notification behavior can leak user event data to third parties and trigger unintended communications without informed consent.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code hardcodes Telegram delivery and a fixed recipient number, causing event titles and timing information to be sent to an external party unrelated to the user. This creates a direct confidentiality risk and could also be abused for unauthorized messaging or data exfiltration if the skill is used with sensitive reminders.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill documents persistent storage of personal event data in a workspace YAML file but does not provide a prominent privacy warning about retention, local exposure, or Git synchronization implications. Calendar entries can contain sensitive personal, family, work, and health-related information, so silent persistence increases confidentiality risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill states that reminders are delivered through Telegram by default in the free version, but does not provide a clear warning that reminder content may be transmitted to an external service. This creates a privacy and data-sharing risk because event titles, times, and notes may leave the local environment without explicit informed consent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation omits any warning that creating a reminder will spawn jobs that send messages to a fixed Telegram target. This lack of disclosure undermines user consent and can lead operators to run the code believing it is local-only, resulting in unintended disclosure of personal scheduling information.

Static analysis

No suspicious patterns detected.