Security audit
OpenClaw Remiry
Security checks for vulnerabilities and agentic risk
Overview
The plugin's code, instructions, and requirements are internally consistent with a local reminder/expiry tracker and do not request unrelated credentials or installs.
This plugin appears to be what it says: a local reminder and expiry tracker that stores a SQLite DB and image files under ~/.openclaw/extensions/remiry and exposes a local HTTP API. Things to consider before installing: - The API routes are served on the local OpenClaw gateway (127.0.0.1). Local processes may be able to access the plugin endpoints if they can reach the gateway; treat it like any other local service. - Responses return absolute image file paths (e.g. /home/you/...), which may reveal your username/home layout; avoid adding sensitive files as images. - The DELETE all endpoint removes the DB and image files; it requires confirm=true but still be careful and back up data if needed. - Tools are optional and should be allowlisted explicitly; only allow the agent to use remiry_* tools if you trust automated actions that can create/update/delete items. - The repository includes a local .claude/settings.local.json permitting WebFetch to clawhub.ai — that file is a local dev setting and not an explicit runtime requirement of the plugin; review and remove/adjust it if you do not want that permission present in your cloned copy. If these behaviors are acceptable (local storage, possible local-network exposure, and plugin-managed image files), the package is coherent and reasonable to install.
Static analysis
No suspicious patterns detected.
