data-ai-daily-brief

• Outcome: Pass
• Latest audit: Sep 20, 2026 · 4:32 AM UTC
• Version: 5.0.4

Overview

This skill is a disclosed daily-brief generator that can publish reports to configured external channels, so it is coherent but should be used carefully with sensitive content.

Install only if you intend to let the agent create daily briefs and send them to configured chat, email, bot, or GitHub Pages destinations. Review generated content before delivery, avoid confidential source material unless the destination is approved, and use least-privilege service tokens or webhooks.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Tainted flow: 'req' from os.environ.get (line 92, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/deploy_github.py (reported line 94)May include surrounding context.

python

req = urllib.request.Request(url, data=body, headers=headers, method=method)
    try:
        with urllib.request.urlopen(req, context=ctx) as resp:
            return json.loads(resp.read().decode("utf-8")), resp.status
    except urllib.error.HTTPError as e:
        err_body = e.read().decode("utf-8")

Tainted flow: 'req' from os.environ.get (line 131, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/send_telegram.py (reported line 111)May include surrounding context.

python

data = json.dumps(payload, ensure_ascii=False).encode("utf-8")
    req = urllib.request.Request(f"{TG_API}/bot{token}/sendMessage", data=data, headers={"Content-Type": "application/json; charset=utf-8"}, method="POST")
    try:
        with urllib.request.urlopen(req) as resp:
            r = json.loads(resp.read().decode("utf-8"))
            print(f"  ok: {r.get('ok')}, msg_id: {r.get('result',{}).get('message_id','N/A')}")
            return r

Tainted flow: 'req' from os.environ.get (line 131, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/send_telegram.py (reported line 133)May include surrounding context.

python

data = json.dumps(payload, ensure_ascii=False).encode("utf-8")
    req = urllib.request.Request(f"{TG_API}/bot{token}/sendMessage", data=data, headers={"Content-Type": "application/json; charset=utf-8"}, method="POST")
    try:
        with urllib.request.urlopen(req) as resp:
            r = json.loads(resp.read().decode("utf-8"))
            print(f"  ok: {r.get('ok')}, msg_id: {r.get('result',{}).get('message_id','N/A')}")
            return r

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description claims an end-to-end AI agent for generating and distributing daily intelligence briefings across multiple channels with validation and review controls. This code chunk does not implement those core functions. It only performs deployment of an already-existing HTML report to GitHub Pages by using GitHub credentials and API calls to create/check a repository, upload files, archive them, and enable Pages. While deployment could be a supporting part of a larger briefing pipeline, the supplied code chunk’s actual purpose is materially narrower and different from the declared overall behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a broad end-to-end daily briefing system: an AI agent that searches, filters, writes, validates, reviews, and distributes to 9 channels, with configurable domain support. The supplied code chunk does something much narrower: it is a WeCom delivery utility. It reads local Markdown/HTML brief files, extracts a structured summary using parsing heuristics, posts markdown to a WeCom webhook, optionally uploads the HTML document, and uses lock files to prevent duplicate sends. Those behaviors support one delivery adapter, but they do not implement or evidence the upstream AI-agent workflow, multi-channel delivery, machine formatting checks, or review gate claimed in the description. This is a material description-behavior mismatch rather than a mere partial snippet detail because the script’s primary purpose is single-channel push of preexisting content.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The code has real operational capabilities beyond pure local formatting: it can read files, consume credentials from the environment, and publish content to a public GitHub repository over the network. If these capabilities are missing from the declared permission model, reviewers and users may underestimate the risk, especially because this script can make a repository public and publish content externally.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The code has real operational capabilities beyond pure local formatting: it can read files, consume credentials from the environment, and publish content to a public GitHub repository over the network. If these capabilities are missing from the declared permission model, reviewers and users may underestimate the risk, especially because this script can make a repository public and publish content externally.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The code has real operational capabilities beyond pure local formatting: it can read files, consume credentials from the environment, and publish content to a public GitHub repository over the network. If these capabilities are missing from the declared permission model, reviewers and users may underestimate the risk, especially because this script can make a repository public and publish content externally.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 203)May include surrounding context.

md

python deploy_github.py 2026-03-10          # 部署指定日期的日报

环境变量:
  GITHUB_TOKEN       — GitHub Personal Access Token（需要 repo 权限）
  GITHUB_USER        — GitHub 用户名
  GITHUB_REPO        — 目标仓库名（默认 data-ai-daily）
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README_zh.md (reported line 203)May include surrounding context.

md

python deploy_github.py 2026-03-10          # 部署指定日期的日报

环境变量:
  GITHUB_TOKEN       — GitHub Personal Access Token（需要 repo 权限）
  GITHUB_USER        — GitHub 用户名
  GITHUB_REPO        — 目标仓库名（默认 data-ai-daily）
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/deploy_github.py (reported line 11)May include surrounding context.

python

python deploy_github.py 2026-03-10          # 部署指定日期的日报

环境变量:
  GITHUB_TOKEN       — GitHub Personal Access Token（需要 repo 权限）
  GITHUB_USER        — GitHub 用户名
  GITHUB_REPO        — 目标仓库名（默认 data-ai-daily）
"""

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The natural-language note explicitly describes an English-first rewrite of the skill. Under the policy rule, forcing a specific language without user opt-in can violate language/locale requirements, and this line does not mention any user-selectable alternative or justification for the constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README prominently advertises automated multi-channel delivery via webhooks, email, and chat platforms without a clear warning that generated content will be transmitted to third-party services. In the context of an agent skill, this increases the chance that users unknowingly route sensitive internal summaries, prompts, or source material to external systems.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The README’s main description says the skill delivers to 9 channels, presenting that as active current behavior. However, the changelog at L314 explicitly says version 4.2 corrected the actual delivery channels to wecom/github_pages/email replacing 9 virtual channels, which creates a semantic mismatch within the documented behavior of the skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The features section documents 9 delivery channels as a present capability, but the changelog at L314 says the actual delivery channels were corrected to wecom/github_pages/email in version 4.2 replacing 9 virtual channels. This is not merely incomplete documentation; it is an active contradiction about what the skill actually supports.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README states that the skill 'triggers automatically and runs the full pipeline' based on broad natural-language prompts, but it does not define clear confirmation or safety boundaries. In a skill that performs web searches and external delivery, ambiguous auto-invocation can lead to unintended data collection, report generation, and outbound transmission to configured channels.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README documents a natural-language trigger phrase like “生成今天的行业日报”, which is broad enough to overlap with ordinary user requests. In an agent skill system, overly generic triggers can cause accidental auto-activation, leading the skill to perform network searches, content generation, or downstream delivery without the user intentionally invoking this specific skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation emphasizes one-click delivery to nine external channels but does not prominently warn that generated brief content may be transmitted to third-party services. In this skill’s context, accidental inclusion of internal, sensitive, or regulated information in a brief could result in unintended data exfiltration across chat, email, or public hosting targets.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger phrases include broad terms like 'daily brief', 'industry report', and 'newsletter', which can cause the skill to activate in contexts the user did not intend. Because this skill is authorized to read/write files, execute commands, fetch web content, and potentially push outputs externally, accidental activation can lead to unintended workspace changes or outbound content handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description and workflow do not prominently warn that it may write files and push generated content to external channels such as chat platforms, email, or GitHub Pages. In practice, this can surprise users into disclosing sensitive internal summaries, secrets embedded in files, or business information to third-party endpoints without informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The HTML document explicitly sets lang="zh-CN", which fixes the output locale to Simplified Chinese/China. Under the policy, forcing a specific language or locale without user opt-in or a clearly documented regional justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This plain-text skill description forces a specific language/locale in its natural-language content. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring, CLI help text, and runtime messages are written in Chinese, which imposes a specific language on users without any visible opt-in or alternative locale support. The policy explicitly allows locale constraints only when documented and justified or when users are given a choice, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The default configuration hard-codes the language to "zh-CN", which imposes a specific locale in the skill's generated config. Under the policy, locale constraints should either be optional, user-selectable, or clearly justified as region-specific; this file does not present it as an opt-in choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.