Reminder

Create one-time reminder tasks using OpenClaw cron. User specifies reminder time and task content in natural language via Discord, and the task result will b...

This skill appears to do exactly what it says: schedule one-time reminders via openclaw cron and route results back to Discord. Before installing, confirm you trust the openclaw binary on your system and understand how the agent builds the openclaw CLI invocation: the included sanitize-message.sh is conservative (rejects characters like quotes, pipes, redirects, newlines, and some command names) but it cannot substitute for careful argument quoting when the agent constructs the shell command. If you plan to use this skill, review how the agent passes the sanitized text to openclaw (ensure it's passed as a single quoted/escaped argument) and consider additional server-side validation if you require stricter guarantees. Also be aware that session_status reveals deliveryContext (account/channel) which is necessary for delivery but is sensitive routing information.

Type: OpenClaw Skill Name: openclaw-reminder Version: 1.0.5 The skill aims to create reminders, a benign function. The `SKILL.md` explicitly instructs the AI agent to sanitize user-provided task content using `scripts/sanitize-message.sh` before passing it to the `openclaw cron add --system-event` command. The `sanitize-message.sh` script attempts to prevent shell injection and prompt injection by blacklisting command substitutions, shell metacharacters, newlines, double quotes, and dangerous command prefixes. While this demonstrates an awareness of security risks and an attempt to mitigate them, the reliance on a blacklist for sanitization is inherently vulnerable to bypasses. If the `--system-event` argument is eventually executed as a shell command or processed by another agent in a way that allows prompt injection, a bypass of this blacklist could lead to unauthorized execution or manipulation, classifying it as a vulnerability rather than intentional malice.