rem

Manages macOS Reminders from the terminal using the rem CLI. Creates, lists, updates, completes, deletes, searches, and exports reminders and lists. Supports...

Do not run the curl | bash installer blindly. Before installing, do one of the following: (1) Inspect the installer script at https://rem.sidv.dev/install in a browser (or curl it to stdout) to see exactly what it does; (2) Prefer building from source via the listed GitHub module (go install github.com/BRO3886/rem/...) and verify the repository, recent commits, and release tags; (3) If you must run the remote installer, run it in a sandbox/VM and review its network activity and files written; (4) Avoid using the 'rem skills install' commands that write into agent skill directories unless you have inspected the code that will be installed — installing into agent directories grants the skill persistent execution inside those agents; (5) Check for signed releases or release artifacts on an authoritative repository and verify the maintainer identity. If you want, provide the contents of the install script or the GitHub repo URL for a follow-up review.

Type: OpenClaw Skill Name: rem-cli Version: 1.0.0 The skill bundle is classified as suspicious primarily due to its installation method, which involves executing a script downloaded via `curl -fsSL https://rem.sidv.dev/install | bash` as instructed in `SKILL.md`. This is a significant supply chain risk, as it allows arbitrary code execution from an external domain, making the system vulnerable if `rem.sidv.dev` were compromised. Additionally, the `rem` tool's ability to write to sensitive agent skill directories (e.g., `~/.openclaw/skills/rem-cli/`) via `rem skills install` grants it powerful file system access, which, while intended for legitimate skill integration, could be exploited if the `rem` binary itself were compromised. The mention of `REM_NO_UPDATE_CHECK=1` also suggests background network activity for update checks.