Daily Brain

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:39 AM UTC
• Version: 1.0.0

Overview

This is a local daily puzzle skill that reads bundled questions and saves progress locally, with no hidden network, credential, or system-changing behavior found.

Installers should expect a Chinese-first daily puzzle experience that stores local training progress inside the skill directory. Review the optional cron/daily push setup before enabling it, and use the reset command only when you intend to clear progress.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 83% confidence
• Finding: The description and code are related in theme: both concern daily brain-training puzzles across logic, math, memory, and word categories. However, the implementation shown is narrower than the declared experience. The script reads puzzles.json and progress.json, selects a daily puzzle by date, and emits a console prompt instructing downstream generation of an HTML card. It does not itself provide adaptive difficulty logic, real streak tracking, answer handling, or interactive card UI despite the description presenting those as active features. This is a meaningful description-behavior mismatch because several user-facing capabilities are described as implemented, while the supplied code only performs puzzle selection and prompt formatting based on preexisting data.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**权限级别：**
- 以当前用户身份运行，不需要 sudo
- 仅读写 `data/progress.json` 一个文件
- 卸载方法：`rm -rf ~/.claude/skills/daily-brain`

---

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**权限级别：**
- 以当前用户身份运行，不需要 sudo
- 仅读写 `data/progress.json` 一个文件
- 卸载方法：`rm -rf ~/.claude/skills/daily-brain`

---

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Ae1

High

• Category: analysis-evasion

Content

node scripts/stats.js

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest says the skill should trigger on generic phrases such as “逻辑题”, “数学题”, “做道题”, “word game”, and “brain teaser”. These are broad everyday requests and the file does not provide exclusion conditions beyond a separate scope section, increasing the risk of unintended invocation.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: The activation description is explicitly written as “Trigger on” followed by a bilingual list, but the primary skill framing, examples, and operational phrasing are centered on Chinese-language invocation and daily push wording without stating that users may choose their preferred language. This can be read as a locale/language default imposed by the skill rather than an opt-in choice.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- 不创建 cron 任务（推送由外部调度）

**权限级别：**
- 以当前用户身份运行，不需要 sudo
- 仅读写 `data/progress.json` 一个文件
- 卸载方法：`rm -rf ~/.claude/skills/daily-brain`

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The script's natural-language interface, including description, usage guidance, status output, and HTML-card generation instructions, is presented entirely in Chinese. This imposes a specific language on users without any opt-in, fallback, or documented justification for the locale constraint.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code performs a file write to progress.json, updating user progress and history, but the script contains no user-facing warning that running it will persistently modify local data. Aside from the generic title and usage string, there is no print, comment, or prompt disclosing this state-changing behavior before the write occurs.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file's descriptive comment and all user-facing console messages are written only in Chinese, which imposes a specific language on users without offering an opt-in or alternative. The policy explicitly flags language or locale constraints unless they are optional or clearly justified as region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code emits user-facing instructions, labels, and status text exclusively in Chinese, including the main usage context and generated card requirements. The policy for natural-language violations applies to all file types, and there is no opt-in, fallback, or documented justification for forcing a single language/locale.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This JSON file contains user-facing natural-language questions, explanations, and options almost entirely in Chinese, which effectively fixes the skill content to a specific language. The file does not indicate user opt-in, alternate locales, or that the skill is intentionally region-specific.

Natural-Language Policy Violations

Low

• Confidence: 98% confidence
• Finding: The file contains user-facing text and labels exclusively in Chinese, including the title, descriptions, and generated prompt content. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.

Static analysis

No suspicious patterns detected.