Security audit

Drink Water Reminder

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it creates, lists, and removes a named OpenClaw drink-water reminder cron job.

Install only if you want an OpenClaw cron job that persists until removed and announces hydration reminders. Be aware that adding a reminder may replace an existing drink-water-reminder job, and removing reminders deletes all cron jobs with that exact name.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The skill description and usage guidance switch to Chinese at L08 and continue in Chinese for the operational instructions, with no indication that users may choose another language. This creates a locale/language policy issue because it imposes a specific language without opt-in or a documented region-specific need.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script unconditionally removes any existing job with the same name before creating a new one. Although the comment explains this behavior to a reader of the code, there is no user-facing disclosure such as a prompt or printed warning, and the operation is destructive because it deletes an existing scheduled task.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script deletes cron jobs immediately with `openclaw cron rm` and does not perform any user confirmation, dry-run, or secondary validation before the destructive action. In a reminder-management skill this can cause unintended deletion of scheduled jobs if the script is triggered in error or if job selection logic matches more entries than expected.

Natural-Language Policy Violations

Low

Confidence: 97% confidence
Finding: The default message string is hardcoded in Chinese, which imposes a specific language choice on users who do not supply their own message. The policy allows language constraints only when users are given a choice or the locale restriction is clearly documented and justified.

Natural-Language Policy Violations

Low

Confidence: 96% confidence
Finding: The script prints the message "未找到 drink-water-reminder 任务" when no matching job is found, which imposes a specific language on users. The file provides no option to select locale and no documentation indicating this is intentionally region-specific.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The script's only user-visible output strings are in Chinese, which imposes a specific language on users without opt-in or explanation. This can violate language/locale policy when the skill is not clearly documented as Chinese-only or region-specific.

Static analysis

No suspicious patterns detected.