Morning Briefing

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:54 PM UTC
• Version: 1.0.2

Overview

This skill is coherent for morning briefings, but it depends on an unpinned external npm CLI that would handle sensitive calendar and reminder data.

Review this before installing. The skill itself is transparent about what it does, but the actual executable comes from an unpinned npm package that was not present for inspection. Install only if you trust that package and publisher, prefer a pinned reviewed version, and avoid putting real license keys directly in shell history if a safer activation method is available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned Third-Party npm Package Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code:

yaml

metadata: { "openclaw": { "emoji": "🌅", "os": ["darwin"], "requires": { "bins": ["briefing"] }, "install": [{ "id": "node", "kind": "node", "package": "@openclaw-tools/morning-briefing", "bins": ["briefing"], "label": "Install morning-briefing (npm)" }] } }

Technical Analysis

The installation metadata references @openclaw-tools/morning-briefing without an exact version or an integrity hash. Consequently, installation may resolve to whichever package release the npm registry currently considers applicable rather than to a release whose contents were reviewed with this project.

The dependency's implementation is not included in the audited artifact, so its runtime behavior and npm lifecycle scripts cannot be verified here. If the publisher account, package, registry response, or a future release is compromised, malicious code could execute during installation or when the briefing executable is invoked.

Attack Path

1. An attacker compromises the npm publisher account, package distribution process, or a later package release.
2. The attacker publishes a malicious version of @openclaw-tools/morning-briefing.
3. A user installs the Skill dependency using the unpinned package declaration.
4. npm resolves and downloads the attacker-controlled release.
5. Malicious lifecycle scripts execute during installation, or malicious logic executes when the user runs briefing.
6. The payload operates with the permissions of the installing or invoking user.

Impact Assessment

Successful exploitation could permit arbitrary code execution in the user's security context. Depending on local permissions, the payload could access user files, configuration, environment credentials, and data available to the CLI. The documented Calendar and Reminders pe ...[truncated 167 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to an exact, reviewed version rather than relying on an implicit latest release.
• Verify the package with an npm lockfile and registry-provided integrity hash.
• Reference a verified source repository and review the package source, published archive, and lifecycle scripts.
• Disable npm lifecycle scripts during installation where they are unnecessary, such as with --ignore-scripts.
• Monitor the pinned package for security advisories and update it only through a controlled review process.
• Consider distributing reviewed source with the Skill or using a reproducible build and signed release artifacts.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:35

Finding

License Key Passed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 35
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Low

Vulnerable Code:

text

Activate: `briefing activate <license-key>`

Technical Analysis

The documented activation procedure instructs users to provide a license key directly as a command-line argument. Secrets supplied this way may be retained in shell history, terminal transcripts, automation logs, debugging output, or process-monitoring records. On systems where process arguments are visible to other users or monitoring agents, the key may also be exposed while the command is running.

This issue concerns the documented secret-entry mechanism. The audited artifact does not include the CLI implementation, so it is not possible to determine whether the application subsequently protects, transmits, or stores the key securely.

Attack Path

1. A user runs the documented activation command with a real license key.
2. The shell records the complete command in its history, or another logging or monitoring component captures it.
3. A local user, administrator, support operator, backup reader, or log consumer obtains access to that record.
4. The observer extracts the license key and attempts to activate or use it without authorization.

Impact Assessment

Exploitation could disclose the license credential and enable unauthorized activation or use, subject to the licensing service's validation and device restrictions. This does not directly establish operating-system privilege escalation or arbitrary code execution. The affected scope is primarily the confidentiality and potential unauthorized reuse of the supplied license key.

Remediation

View remediation

Remediation Suggestions

• Change activation to prompt for the key interactively with terminal echo disabled.
• Support reading the key from standard input or a protected operating-system credential store.
• Avoid placing the key in environment variables unless their exposure characteristics are explicitly addressed.
• Ensure the CLI redacts credentials from logs, errors, telemetry, and diagnostic output.
• If command-line activation must remain available, clearly warn users about shell-history and process-list exposure and provide instructions for securely removing affected history entries.
• Store any persisted activation credential with restrictive file permissions or in the macOS Keychain.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description includes broad, common trigger phrases such as 'daily summary,' 'schedule overview,' and 'automated daily briefings,' which can cause the skill to be invoked in situations the user did not specifically intend. Because this skill accesses local calendar, reminders, weather, and news via a CLI, accidental invocation can expose sensitive personal context or cause unexpected scheduled automation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.