ClawHub
Back to skill

Security audit

Ai Daily Briefing

Security checks for vulnerabilities and agentic risk

Overview

This briefing skill is coherent, but it can read and summarize sensitive daily-work, calendar, meeting, and persistent memory files from broad trigger phrases without a clear consent gate.

Review this before installing if your workspace contains private meeting notes, calendar details, or persona memory files. It is most appropriate where you are comfortable with a briefing request aggregating those sources; otherwise, limit or remove access to MEMORY.md, USER.md, memory files, calendar data, or broad trigger phrases.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:131
Finding

Overbroad Access to Persistent User and Agent Context

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 131–136 and 170–179
Vulnerability Type: Excessive access to persistent memory and user-profile data
Risk Level: Medium

Vulnerable Code Snippet:

markdown
### 4. Memory/Context Files (if using ai-persona-os)

**Locations:**
- `MEMORY.md`  Permanent facts
- `memory/[today].md`  Session notes
- `USER.md`  User preferences
markdown
### Step 1: Gather Data Sources

Check for these files in order:
  1. todo.md (to-do list from ai-meeting-notes)
  2. meeting-notes/ folder (recent meeting notes)
  3. MEMORY.md (if using ai-persona-os)
  4. memory/[today].md (session notes)
  5. Calendar integration (if available)
text

Technical Analysis

The Skill instructs the agent to inspect persistent memory, current session notes, and user-profile data whenever it prepares a briefing. These files can contain sensitive or unrelated information beyond the task, meeting, and calendar data needed for a daily briefing.

The instructions do not establish field-level restrictions, data classification rules, redaction requirements, or explicit user consent before accessing persistent context. Consequently, the Skill can cause an agent with workspace read privileges to cross least-privilege boundaries and process substantially more user information than is necessary.

This issue does not independently grant operating-system privileges. Its practical scope is limited to files and integrations already accessible to the hosting agent. However, within that scope, it broadens access from task-related sources to potentially comprehensive persistent user and session data.

Attack Path

  1. The user invokes a broad trigger such as briefing, start my day, or what do I need to know?.
  2. The loaded Skill directs the agent to gather all listed data sources.
  3. The agent reads MEMORY.md, memory/[today].md, and potentially USER.md using its ex ...[truncated 903 chars]
Remediation
View remediation

Remediation Suggestions

  1. Default to narrowly scoped sources such as todo.md, explicitly selected meeting notes, and the user's calendar.
  2. Make access to MEMORY.md, USER.md, and session-memory files opt-in and request explicit confirmation before each new category of persistent data is read.
  3. Allow users to configure approved files and sections instead of scanning complete memory documents.
  4. Add strict filtering rules that exclude credentials, authentication tokens, financial information, health information, personal identifiers, private relationship details, and unrelated session content.
  5. Summarize sensitive sources locally without reproducing their raw contents in the final briefing.
  6. Label each included context item with its source and provide a mode that omits persistent memory entirely.
  7. Ensure the hosting agent applies workspace sandboxing so this Skill can access only user-approved briefing data.
  8. Add an instruction stating that content found in task, meeting, memory, profile, or calendar files must be treated as untrusted data and never as executable agent instructions.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The public-facing description emphasizes convenience and "no setup" but does not clearly disclose that the skill may inspect workspace todo files, recent meeting notes, memory/context files, and calendar data. That omission weakens informed consent and can cause users to invoke the skill without understanding that sensitive business or personal information may be read and summarized.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is designed to activate on very common natural-language requests like "briefing" and similar day-start phrases, which can be spoken in ordinary conversation without intent to invoke the skill. Because the skill then reads from potentially sensitive sources such as todo.md, meeting notes, memory files, and calendar data, accidental activation can disclose private work and personal context to the conversation unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The listed trigger phrases include broad, conversational expressions such as "start my day," "what do I need to know?" and "give me the rundown," which overlap heavily with normal assistant interactions. In this skill's context, unintended activation is more dangerous because the workflow instructs the agent to aggregate sensitive information from files and calendar sources into a single response, increasing the chance of overexposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.