Daily Rhythm

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:18 AM UTC
• Version: 1.0.0

Overview

Daily Rhythm appears purpose-built rather than malicious, but it needs review because it handles Google and Stripe data with recurring automation, plaintext local storage, and hard-coded workspace paths.

Review before installing. Edit the scripts to remove /Users/tom paths, enable only the integrations you need, use least-privilege Google and Stripe credentials, keep .env.stripe and OAuth token files out of version control, and add only cron jobs you know how to remove. Treat generated memory files as sensitive because they may contain task notes, personal reflections, revenue metrics, and customer identifiers.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs users to use network access, local file read/write, and environment-based secrets, but it declares no permissions or trust boundaries. That omission can mislead users and reviewers about what data the skill will access and persist, especially because it handles task data, calendar feeds, and Stripe credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The skill is presented as a personal daily-routine assistant, but it also pulls Stripe subscription data and computes ARR metrics, which expands its data access into business-sensitive analytics. This mismatch increases the chance that a user enables the skill for benign productivity use without realizing it can access financial information and persist derived revenue data locally.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The template expands a daily routine skill into business/financial processing by syncing Stripe ARR, which is not necessary for morning briefs or reflection workflows. This creates unnecessary access to sensitive financial data and broadens the blast radius if the skill is misconfigured, compromised, or used in an environment where finance access was never expected.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The template instructs sending daily brief content through third-party messaging platforms, which can expose calendar data, tasks, priorities, weather, and unresolved items outside the primary system boundary. In a routine/planning skill, this is more dangerous because users may assume a private assistant context and not expect their personal schedule data to be transmitted to external services.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script for a daily routine skill pulls Stripe ARR data even though the declared purpose is morning planning and reflection. This hidden finance-data synchronization expands the skill's access to sensitive business information without clear user expectation, creating a risk of unauthorized collection, exposure, or misuse if the script is run in a broader automation context.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Including business-finance data synchronization in a personal daily-rhythm automation script violates the principle of least privilege and indicates capability creep beyond the stated use case. In context, this makes the skill more dangerous because users invoking a benign productivity tool would not reasonably expect it to access revenue data, increasing the chance of silent sensitive-data handling.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The script imports all Google Tasks content and persists it into a local 'memory' JSON file, which materially expands the skill from prompting/planning into external data collection and storage. That creates unnecessary exposure of potentially sensitive task titles and notes, especially because the manifest does not clearly disclose this behavior or justify broad task ingestion.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The script performs OAuth authorization against a Google account and accesses third-party task data, which is a sensitive capability beyond simple daily routine prompting. Even with a read-only scope, this grants the skill access to personal productivity data that may contain confidential notes, deadlines, and links, increasing privacy and misuse risk if not clearly justified and consented to.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The script performs Stripe subscription retrieval and ARR synchronization, which is unrelated to the declared daily planning and routine-management purpose of the skill. This mismatch is dangerous because it indicates hidden financial-data access behavior embedded in an unrelated skill, increasing the likelihood of unauthorized data collection or covert exfiltration within a trusted context.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code loads a Stripe API key from local environment files and uses it to query active subscriptions, despite the skill being presented as a daily-routine assistant. Accessing billing credentials and customer subscription records without any functional need is a strong indicator of unauthorized sensitive-data access and could expose financial and customer information.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script persists ARR, customer counts, and customer identifiers into workspace memory files that are unrelated to the skill's stated daily-rhythm functionality. Persisting unrelated business metrics and identifiers expands the blast radius of a compromise and creates unauthorized retention of sensitive operational data inside a misleading skill.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill processes potentially sensitive calendar entries, task content, and optional revenue data, yet the description does not warn users that this information may be fetched from external services and stored in local files. Missing disclosure raises privacy and data-handling risk because users may expose personal or business-sensitive information without understanding retention and access implications.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The template stores the user's wind-down response in persistent memory without warning the user that reflective or personal planning content will be retained. Because these responses may include sensitive personal goals, emotional state, health-related habits, or future plans, silent persistence creates a privacy risk and can violate user expectations around ephemeral coaching prompts.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The template packages personal schedule, task, priority, and possibly location-derived weather information into outbound messages without any privacy warning or consent language. This is risky because external messaging services may retain content, expose it across devices, or make sensitive daily routine information available if accounts are shared or compromised.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The configuration explicitly tells users to store a live Stripe secret key and a private calendar ICS URL in local files, but it provides no warning that these are sensitive secrets that can grant billing-data access or expose private calendar contents. In a skill meant for routine automation, normalizing plaintext secret placement without security guidance increases the chance of accidental disclosure through backups, repo commits, logs, or broader workspace access.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The OAuth token is serialized to disk in a predictable location without any user-facing warning, which can expose long-lived access material to other local users, backups, or malware on the host. Although local token storage is common, doing so silently and without access-control hardening increases the chance of credential theft and unauthorized API access.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script writes fetched Google Tasks data, including titles, notes, links, and due dates, to a local JSON file without explicit disclosure. This creates a secondary plaintext copy of potentially sensitive personal information that may be accessible to other software, users, backups, or logs on the machine.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script writes Stripe-derived customer data, including customer IDs and revenue metrics, to local files without any disclosure, consent flow, or data-handling notice. Even if not immediately exfiltrated, local persistence of customer-linked billing data increases the risk of secondary access, unintended sharing, or long-term retention beyond the original collection purpose.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.