Daily Standup Generator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:54 AM UTC
• Version: 1.0.0

Overview

This standup skill is not malicious, but it can read prior memory and conversations without clear limits, which could put unrelated private information into a report.

Review this skill before installing if your agent has memory or chat-history access. Use it only with clear instructions such as the allowed project, date range, and source list, and check the generated report before sharing it with a team.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:30
• Finding: Unscoped Access to Persistent Memory and Conversation History## Vulnerability Details **File Location**: `SKILL.md`, lines 30–33 **Vulnerability Type**: Unrestricted access to potentially sensitive contextual data **Risk Level**: Medium **Complete Code Snippet**: ```markdown ## Data Sources 1. Check memory files for recent tasks 2. Read conversation history for work context 3. Ask user for specific tasks if unclear ``` ### Technical Analysis The skill directs the agent to inspect memory files and conversation history without requiring explicit user authorization or defining boundaries such as a project, conversation, source, or date range. These data stores may contain credentials, personal information, confidential project material, or other content unrelated to the requested standup report. If the hosting agent grants access to these sources, the instruction may violate least-privilege principles by causing broader retrieval than the task requires. Retrieved material could then be incorporated into a team-facing report. The file does not contain instructions to transmit information over a network, execute code, or elevate operating-system privileges; therefore, the exposure is limited to data already accessible to the agent. ### Attack Path 1. A user invokes the daily standup skill. 2. The skill instructs the agent to search persistent memory files and conversation history. 3. The agent retrieves records beyond the current request because no project, source, or date boundary is specified. 4. Sensitive or unrelated information is treated as work context. 5. That information may be summarized in a standup report and disclosed to unintended recipients. ### Impact Assessment The skill does not obtain new system privileges. However, it may exercise the agent's existing read access more broadly than necessary. Potentially exposed data includes unrelated task history, private conversations, personal information, confidential project details, and secrets stored in accessible contex ...[truncated 127 chars]
• Remediation: ## Remediation Suggestions - Use information supplied in the current request as the default and primary data source. - Require explicit user consent before reading persistent memory or prior conversations. - Ask the user to identify the permitted project, conversations, files, and date range. - Retrieve only the minimum records needed to prepare the report. - Exclude credentials, secrets, personal information, and unrelated project content from generated output. - Present retrieved items for user confirmation before placing them in a team-facing report. - If the allowed scope is unclear, ask the user for task details rather than searching memory or conversation history. - Enforce access controls at the host level so the skill can access only user-approved contextual sources.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest and usage section use broad phrases such as "standup", "User asks for daily standup report", and "User wants to summarize yesterday's work" without clear constraints or negative examples. These triggers overlap with common workplace conversation and do not clearly define when this skill should or should not activate.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The trigger includes Chinese text and the required output headings are specified in Chinese, but the document does not state that the skill is region-specific or allow the user to choose another language. This may violate language or locale policy by imposing a specific language without user opt-in.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs the agent to check memory files and conversation history for task and work context without requiring clear user notice or consent at time of use. This can lead to privacy-sensitive data being collected, repurposed, or surfaced in a standup report unexpectedly, especially if prior chats or stored memory contain unrelated confidential information.

Static analysis

No suspicious patterns detected.