daily review manager

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:09 AM UTC
• Version: 1.0.0

Overview

This skill is a plausible daily review recorder, but it can automatically process and save sensitive text or voice content with loose triggers and limited user-control detail.

Install only if you are comfortable with a Chinese-language journaling skill that may save personal or work reflections to a workspace Markdown file. Before using voice or messaging integrations, configure explicit confirmation before transcription/saving, keep storage local unless you intentionally authorize cloud storage, and pin transcription dependencies in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:252

Finding

Unpinned Third-Party Speech Transcription Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 252-257
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown

### Dependency Tools

| Tool | Purpose | Installation Method |
|------|---------|---------------------|
| ffmpeg | Voice file processing | Bundled with the system or apt install ffmpeg |
| whisper | Speech-to-text conversion | pip install openai-whisper |

Technical Analysis

The documented installation command retrieves openai-whisper and its transitive dependencies without specifying an audited version or verifying package integrity. Consequently, the code installed by users may differ from the dependency that existed when the Skill was reviewed.

Although openai-whisper is presented as a legitimate dependency, the installation guidance does not use a lock file, cryptographic hashes, an explicitly trusted package index, or an isolated environment. A compromised package release, compromised transitive dependency, package-index account takeover, or future unsafe release could therefore introduce attacker-controlled code into the Skill's runtime environment.

This is a supply-chain weakness rather than evidence that the current openai-whisper package is malicious.

Attack Path

1. A user follows the setup instructions and runs pip install openai-whisper.
2. pip resolves the latest compatible release and its transitive dependencies at installation time.
3. An attacker compromises a relevant package release, maintainer account, dependency, or configured package source.
4. The compromised component is downloaded because no approved version or integrity hash is enforced.
5. Malicious code executes during package installation where applicable, or later when the package is imported or invoked for voice transcription.
6. The malicious component operates with the privileges of the user running the installation or ...[truncated 642 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin openai-whisper and every transitive dependency to versions that have been reviewed and tested.
2. Record dependencies in a lock file or hashed requirements file, and install them with integrity enforcement:

   bash

   python3 -m venv .venv
   . .venv/bin/activate
   python3 -m pip install --require-hashes -r requirements.txt
   

3. Generate requirements.txt with exact versions and SHA-256 hashes from a controlled build environment.
4. Configure pip to use an explicitly trusted package index or an internally maintained package mirror.
5. Install and execute transcription dependencies in an isolated, least-privileged environment without unnecessary access to credentials or unrelated user files.
6. Scan and periodically update pinned dependencies through a controlled review process rather than accepting the latest release automatically.
7. Document the supported Python version and verified dependency versions directly in SKILL.md.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill describes writing review content to a Markdown file but does not declare any explicit tool scope such as allowed file operations or path restrictions. That creates an authorization gap where an agent implementation may perform file writes without clear least-privilege boundaries, increasing the chance of unintended or broader-than-expected filesystem access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases include very common terms like '周报', '月报', and '流水账', which can appear in ordinary conversation and cause the skill to activate unexpectedly. In a skill that records and stores user content, unintended activation can lead to silent capture, processing, or persistence of sensitive personal information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The keyword-matching logic for text input is loosely defined and relies on ambiguous phrases like '帮我记录' or '记录一下' without sufficient intent validation. This increases the risk that unrelated chat messages are interpreted as review entries and then stored, summarized, or transformed without the user's clear consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill specifies automatic download of voice messages, transcription, and storage, but does not require an explicit privacy notice or consent step before processing potentially sensitive audio. Because daily reviews often contain personal, workplace, health, or emotional information, automatic handling materially raises privacy and data-protection risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The module docstrings and user-facing descriptions are all in Chinese, including the class and method descriptions. This imposes a specific language on users without any visible opt-in or explanation that the skill is intended only for a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The code appends user-derived content directly into a Markdown file without any disclosure, consent flow, or safeguards around where and how that content will be stored. In this skill context, users may speak sensitive diary, review, or work-summary information; silently persisting it can create privacy and data-handling risks, especially if the file path is externally influenced or the Markdown is later rendered in another system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown template presents all instructions, headings, and labels exclusively in Chinese. Under the stated policy, forcing a specific language without offering user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.