Ai Daily Briefing

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:56 AM UTC
• Version: 2.0.0

Overview

This is a readable daily-briefing skill that uses expected productivity sources, but users should know it may read private task, meeting, calendar, and memory context when invoked.

Install this only if you are comfortable with a briefing skill reading local productivity context such as tasks, recent meeting notes, calendar data, and AI memory/profile files. Consider using explicit phrases like 'daily briefing' and ask it to skip memory or calendar sources if those may contain sensitive material.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:131

Finding

Overbroad Access to Persistent User Memory and Context Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 131–179
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Code

markdown

### 4. Memory/Context Files (if using ai-persona-os)

**Locations:**
- `MEMORY.md`  Permanent facts
- `memory/[today].md`  Session notes
- `USER.md`  User preferences

markdown

### Step 1: Gather Data Sources

Check for these files in order:

1. todo.md (to-do list from ai-meeting-notes)
2. meeting-notes/ folder (recent meeting notes)
3. MEMORY.md (if using ai-persona-os)
4. memory/[today].md (session notes)
5. Calendar integration (if available)

Technical Analysis

The Skill instructs the Agent to inspect persistent memory, current session notes, and user-profile information while preparing a daily briefing. These sources can contain sensitive personal facts, preferences, conversation history, or information unrelated to the requested task.

The instructions do not require explicit user consent before accessing these files, define permitted fields, exclude secrets, or establish relevance and sensitivity filters. Consequently, the Skill can read more workspace context than is strictly necessary for summarizing tasks and meetings. This represents a least-privilege boundary issue within the Agent's available workspace access.

The access is conditional on the files or integration being available. No evidence was found that the Skill bypasses operating-system permissions, retrieves credentials, sends the resulting data to an external service, or acquires additional system privileges.

Attack Path

1. A workspace contains MEMORY.md, memory/[today].md, or USER.md.
2. These files contain private facts, preferences, session information, or unrelated sensitive material.
3. The user invokes a recognized briefing trigger such as “briefing” or “start my day.”
4. The Skill directs the Agent to inspect the memory and context files as briefing data sou ...[truncated 874 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user consent before reading persistent memory, session notes, or profile files.
2. Default the Skill to task-specific sources such as todo.md and explicitly selected meeting notes.
3. Allow users to opt in to each additional source independently.
4. Restrict extraction to a documented allowlist of fields relevant to deadlines, meetings, and priorities.
5. Exclude credentials, authentication tokens, financial data, health information, private communications, and unrelated personal facts.
6. Add a sensitivity and relevance review before including memory-derived information in the briefing.
7. Identify the source of proposed memory-derived context and ask for confirmation before displaying sensitive content.
8. Provide a privacy-preserving mode that never reads MEMORY.md, USER.md, or the memory/ directory.
9. Ensure calendar and file integrations use read-only, narrowly scoped permissions.
10. Document exactly which sources were accessed when generating each briefing.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill markets itself as 'No setup. Just say briefing' but does not warn users that it may inspect sensitive sources including task lists, meeting notes, memory files, and calendar data. This lack of disclosure undermines informed consent and increases the chance that users expose confidential business information, personal schedules, or private notes without realizing the scope of access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list includes broad, natural phrases like 'start my day', 'what do I need to know?', and 'give me the rundown', which can plausibly appear in ordinary conversation without the user intending to invoke this skill. Because the skill then reads from sensitive local sources such as todo.md, meeting-notes/, MEMORY.md, and USER.md, accidental invocation can cause unintended disclosure of personal or work context into the chat.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.