Security audit

Daily Report Recorder

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward daily work-report recorder that stores user-provided work notes locally, with some persistence and auto-trigger behavior users should understand before installing.

Install this only if you want work updates you provide to be saved and merged into local daily Markdown reports. Avoid entering confidential details unless /data/reports/daily is an appropriate storage location for them, and review the optional cron example carefully before enabling scheduled prompts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The README presents the skill entirely in Chinese and describes outputs such as enterprise-style daily reports in Chinese, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in can be a locale policy violation unless the regional restriction is explicit and justified.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README describes automatic recording, organization, and archiving of user work content to a concrete file path, but does not present a clear user-facing notice about persistence, retention, or sensitivity of the stored data. In a workplace reporting context, this can expose internal project details, incident notes, or operational information without informed user consent.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger conditions are broad, generic workplace phrases such as meeting notes, environment setup, testing, and follow-up plans, which are common in normal conversation. This increases the chance of unintended activation and silent capture or transformation of user content into a persisted report, especially because the skill is designed to auto-record and merge entries.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs automatic creation and overwrite of persistent files without requiring explicit user confirmation or warning that local state will be modified. This can cause unintended retention, duplication, or corruption of sensitive work notes, especially when the user is only asking for drafting or preview rather than storage.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The manifest description is written as a requirement to record, polish, and archive the user's daily work content and generate/update a daily report in Markdown, and it specifies this behavior in Chinese without any indication that the user can choose another language. This creates a natural-language locale policy concern because the skill appears to enforce a specific language/locale by default rather than offering user opt-in or choice.

Intent-Code Divergence

Low

Confidence: 90% confidence
Finding: L013 states the assistant must only organize information explicitly provided by the user and must not fabricate or supplement results. However, L081 and L087-L090 instruct it to automatically add Asia/Shanghai timestamps to work items, which introduces new content not supplied by the user. This is a direct documentation-level contradiction about whether the skill may augment report content.

Natural-Language Policy Violations

Low

Confidence: 83% confidence
Finding: The instructions require timestamps to use the `Asia/Shanghai` timezone for all generated entries, which imposes a locale-specific setting without indicating user choice or a documented regional limitation. Under the policy, locale constraints should be optional or clearly justified as region-specific.

Static analysis

No suspicious patterns detected.