Medication Reminder

Track medications with dosing schedules and intake history. Use when managing prescriptions.

This skill appears to be a simple, local medication tracker and is coherent with its description. Before installing, review and consider: (1) Privacy — it stores health data in plaintext at ~/.local/share/medication-reminder; if that is sensitive, run it in a restricted account, encrypt the directory, or modify the script to use encrypted storage. (2) Minor bugs and robustness — the script uses unquoted variable expansions when building JSON and when redirecting, which can break with unusual medication names (spaces, quotes) and may produce malformed JSON; it also prints literal 'Added $2' messages due to quoting. If you plan to use it long-term, consider hardening: quote expansions, validate/sanitize inputs, use a JSON library (jq) or printf to build safe JSON, and add error handling for concurrent writes. (3) Run in a sandbox or inspect the script locally before invoking, as with any third-party script. No network/credential exfiltration was observed.

Type: OpenClaw Skill Name: medication-reminder Version: 3.0.0 The script `scripts/script.sh` contains multiple critical shell injection vulnerabilities in the `add`, `take`, and `history` commands because user-supplied arguments (e.g., `$2`, `$3`) are expanded outside of quotes within `echo` and `tail` commands. Additionally, the script contains an unusually large block of empty comments (lines 11–85), which is a common technique used to hide malicious code or bypass simple scanners, although no active payload was found in this specific version.