Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed, local-only Argentina/LATAM morning briefing skill with narrow file access and no executable code, network use, or credential handling.
Install this if you want an Argentina/LATAM-oriented morning briefing. Review the broad aliases if you often use greetings casually, and only place sensitive meetings or tax details in ~/centriqs/briefing/agenda.md or config.md if you are comfortable with the skill using them in private briefings.
The skill advertises activation on very common conversational phrases such as "buenos días", "qué hay hoy", and "cómo arrancamos", which are broad enough to overlap with ordinary chat. This can cause unintended invocation of the skill, leading to surprise execution, incorrect routing of user intent, and possible leakage of contextual data into the skill when the user did not explicitly request it.
The manifest description instructs activation on broad requests like 'resumen de la mañana', 'agenda del día', or an automatic heartbeat, which creates ambiguous matching criteria. In a multi-skill environment this can lead to accidental invocation, unintended data access, or the skill overshadowing other agent behaviors when users make ordinary scheduling requests.
The file instructs the agent to always use ART and to never use UTC or MM/DD/YYYY, and later requires day names in Spanish. This is a language/locale constraint presented as unconditional behavior rather than a user-selectable preference, which can violate locale-choice policy.
The skill registers highly generic natural-language triggers such as common greetings and check-ins, which can cause unintended activation during ordinary conversation. That can make the agent inject briefing behavior and read local workspace data like agenda or config when the user did not explicitly request this skill, creating context confusion and potential privacy exposure.
No suspicious patterns detected.
