qqbot-remind-absolute

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:04 AM UTC
• Version: 1.0.0

Overview

The skill is a real QQ reminder scheduler, but it needs review because cancellation and scheduled-agent behavior are too broadly scoped.

Install only if you are comfortable with this skill creating persistent OpenClaw cron jobs for QQ reminders. Review or fix ownership checks before using it in a shared or multi-user environment, especially cancellation by job ID, and ensure scheduled reminder agents run with minimal tools and no sensitive file or credential access.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/schedule_reminder.py:244

Finding

Unscoped Cron Job Deletion Permits Cross-User Task Cancellation

Content

View full analysis

"` 3. The script does not require a QQ target or authenticated owner identity. 4. The script executes `openclaw cron rm --json`. 5. OpenClaw deletes the referenced job if it is visible to the process, even when it belongs to another QQ user or is unrelated to this reminder skill. ### Impact Assessment An attacker with a valid job ID can delete any OpenClaw cron job accessible to the process. This may cancel another user's reminders o ...[truncated 292 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/schedule_reminder.py:171

Finding

Untrusted Reminder Content Is Interpolated into a Future Agent Prompt

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

- `python scripts/schedule_reminder.py set-timezone --to "<qq-target>" --timezone "<IANA timezone>"`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

- `python scripts/schedule_reminder.py set-timezone --to "<qq-target>" --timezone "<IANA timezone>"`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

- `python scripts/schedule_reminder.py set-timezone --to "<qq-target>" --timezone "<IANA timezone>"`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

- `python scripts/schedule_reminder.py set-timezone --to "<qq-target>" --timezone "<IANA timezone>"`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

- `python scripts/schedule_reminder.py set-timezone --to "<qq-target>" --timezone "<IANA timezone>"`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

- `python scripts/schedule_reminder.py set-timezone --to "<qq-target>" --timezone "<IANA timezone>"`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

- `python scripts/schedule_reminder.py set-timezone --to "<qq-target>" --timezone "<IANA timezone>"`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

- `python scripts/schedule_reminder.py set-timezone --to "<qq-target>" --timezone "<IANA timezone>"`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

- `python scripts/schedule_reminder.py set-timezone --to "<qq-target>" --timezone "<IANA timezone>"`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

- `python scripts/schedule_reminder.py set-timezone --to "<qq-target>" --timezone "<IANA timezone>"`

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The remove action deletes any cron job by ID without checking that the job belongs to the requesting QQ user. If a user can obtain or guess another job ID, they can cancel someone else's reminders, creating a direct authorization bypass and cross-user integrity issue.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to invoke Python scripts that read and write local state and can create real cron jobs, but it declares no explicit tool scope or permission boundaries. That creates an over-privileged integration surface where an agent may execute shell/file operations without transparent constraints, increasing the risk of command misuse, unauthorized file access, or persistence via scheduled jobs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation text is very broad and matches common reminder-related language, which can cause the skill to trigger in contexts the user did not intend. Because this skill performs real side effects such as creating cron jobs and storing per-user timezone state, over-broad routing can lead to accidental reminder creation, modification, or cancellation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

All reply examples are Chinese and the skill provides no opt-in or fallback for users who prefer another language. This creates a natural-language locale policy concern because the skill appears to force a specific language rather than offering choice or documenting that it is intentionally Chinese-only.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/schedule_reminder.py (reported line 56)May include surrounding context.

python

]
    for candidate in candidates:
        try:
            result = subprocess.run([candidate, "--version"], capture_output=True, text=True, encoding="utf-8", errors="replace")
            if result.returncode == 0 or result.stdout or result.stderr:
                return candidate
        except FileNotFoundError:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/schedule_reminder.py (reported line 73)May include surrounding context.

python

def run_cmd(cmd: list[str]) -> subprocess.CompletedProcess[str]:
    return subprocess.run(cmd, capture_output=True, text=True, encoding="utf-8", errors="replace")


def ensure_timezone(target: str, explicit_timezone: str | None) -> str:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script emits only Chinese-language error and guidance messages, such as the invalid-timezone and first-time setup prompts. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which this file does not do.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The constructed message instructs the downstream assistant in Chinese and requires a specific output style, implicitly forcing Chinese-language reminders for all users. This violates the language/locale policy unless the skill offers a language choice or clearly documents a justified regional constraint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The list action retrieves all cron jobs globally and only filters them after the full dataset is returned to this script. That exceeds the stated per-user reminder scope and can expose metadata about other users' jobs to the component, increasing the blast radius if logs, errors, or future code changes leak unfiltered results.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The reference text states that reminder times are resolved to absolute datetimes in Asia/Shanghai before scheduling, which can override or preempt user-specific timezone selection. In a reminder skill, forcing a timezone without explicit user opt-in can cause reminders to fire at the wrong real-world time, creating integrity and reliability issues for time-sensitive notifications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.