Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it claims: it creates, lists, and removes a named OpenClaw drink-water reminder cron job.
Install only if you want an OpenClaw cron job that persists until removed and announces hydration reminders. Be aware that adding a reminder may replace an existing drink-water-reminder job, and removing reminders deletes all cron jobs with that exact name.
The skill description and usage guidance switch to Chinese at L08 and continue in Chinese for the operational instructions, with no indication that users may choose another language. This creates a locale/language policy issue because it imposes a specific language without opt-in or a documented region-specific need.
The script unconditionally removes any existing job with the same name before creating a new one. Although the comment explains this behavior to a reader of the code, there is no user-facing disclosure such as a prompt or printed warning, and the operation is destructive because it deletes an existing scheduled task.
The script deletes cron jobs immediately with openclaw cron rm and does not perform any user confirmation, dry-run, or secondary validation before the destructive action. In a reminder-management skill this can cause unintended deletion of scheduled jobs if the script is triggered in error or if job selection logic matches more entries than expected.
The default message string is hardcoded in Chinese, which imposes a specific language choice on users who do not supply their own message. The policy allows language constraints only when users are given a choice or the locale restriction is clearly documented and justified.
The script prints the message "未找到 drink-water-reminder 任务" when no matching job is found, which imposes a specific language on users. The file provides no option to select locale and no documentation indicating this is intentionally region-specific.
The script's only user-visible output strings are in Chinese, which imposes a specific language on users without opt-in or explanation. This can violate language/locale policy when the skill is not clearly documented as Chinese-only or region-specific.
