⏰ simple Telegram reminders for OpenClaw. cron, zero dependencies.
Security Analysis
high confidenceThe skill's requirements and instructions are internally consistent with a reminders/cron helper — it asks for no credentials or installs and only describes scheduling and listing/removing cron jobs.
Name/description (Telegram reminders, cron) align with the content: SKILL.md explains parsing natural-language times and creating/listing/removing cron jobs and delivery templates for channels. The absence of requested credentials is consistent if the platform provides delivery channels/bots centrally.
Instructions are narrowly scoped to parsing times, computing schedules, and calling cron APIs (cron.list, cron.remove, create jobs). They do reference system timezone and using platform cron/delivery; they do not instruct reading unrelated files or exfiltrating data. The 'Janitor' template does instruct deleting matching cron jobs but limits deletion to names starting with 'Reminder:'.
Instruction-only skill with no install spec or external downloads. Nothing is written to disk or installed by the skill itself.
No environment variables, credentials, or config paths are requested. That is reasonable provided the host platform supplies channel delivery capabilities; there are no unexplained secret requests.
always:false and user-invocable:true. The skill can be invoked autonomously (platform default) but does not request permanent elevated privileges or modify other skills. The Janitor template would create a recurring job if the user chooses to install it, but the template's deletion rules are scoped.
Guidance
This skill appears coherent and lightweight, but before installing check two practical things: (1) confirm your OpenClaw host already has the ability to deliver messages to Telegram/Discord/other channels (the skill assumes the platform handles channel credentials), and (2) review any cron jobs you install (especially the 'Janitor' cleanup job) to ensure its name conventions match only reminders you created. No credentials are requested by the skill, but channel posting will rely on the host's integrations — verify those integrations and permissions if you care about which accounts/bots are used to send reminders.
Latest Release
v2.0.2
v2.0.2: Address persistence/privilege scan concern. Skill already enforces: sessionTarget:isolated (sandboxed execution), deleteAfterRun:true (one-shots self-delete), always returns jobId for user audit/cancel, Janitor scoped to Reminder: prefix only. No always:true, no broad permissions.
More by @jacobthejacobs
Published by @jacobthejacobs on ClawHub
