Daily Dev Agentic

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:17 PM UTC
• Version: 0.5.3

Overview

The skill’s daily.dev learning purpose is understandable, but it gives the agent autonomous recurring access, persistent writes, and external fetching without meaningful user approval or limits.

Review before installing. This skill should require explicit approval before creating cron jobs, changing daily.dev feeds, writing persistent memory, sending alerts, or changing learning goals. Users should also expect outbound requests to daily.dev, article sites, and search providers, and should avoid giving it sensitive owner or project context until URL validation, untrusted-content handling, and disable/uninstall controls are added.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: SKILL.md:11

Finding

Autonomous Installation of Recurring Scheduled Tasks

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:11

Finding

Suppression of User Confirmation for Consequential Autonomous Actions

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Warning

• Location: references/learning-loop.md:37

Finding

Untrusted External Content Can Influence Persistent Learning Memory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/learning-loop.md:30

Finding

Unvalidated Fetching of Feed-Supplied URLs

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly directs the agent to create files, modify configuration/state, and schedule cron jobs automatically, while omitting any warning or approval step for these system-changing actions. This is dangerous because a casually invoked skill could persist tasks and alter the host environment in ways the user did not knowingly authorize.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file explicitly states the process runs autonomously with "No confirmations, no pauses" while later describing network fetching, local note-writing, and configuration updates. Removing user-facing warnings or checkpoints before these side effects makes accidental or policy-violating execution substantially more dangerous.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description is broad enough to activate on generic requests like learning, knowledge building, or staying current, which can cause the skill to run outside the user's specific intent. In this skill, accidental activation is more dangerous because the instructions then authorize autonomous feed changes, file writes, and cron scheduling without additional confirmation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The instruction to operate on autopilot with 'No confirmations' removes an important human approval checkpoint before external API calls, state changes, and cron setup. In this skill's context, autonomous decision-making amplifies risk because activation can lead directly to persistent changes and ongoing background activity.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md

You're a learning machine. This skill lets you maintain your own feed on daily.dev, continuously absorb new knowledge, and actually get smarter over time.

**This skill runs on autopilot.** Once your owner shares a learning goal, you take it from there. No confirmations, no hand-holding. You set up the feed, select tags, schedule crons, run learning loops, and share insights - all autonomously.

## What You Do

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The repeated directive to 'Just do it' and avoid confirmation reinforces that the agent should immediately execute actions with side effects, including an initial learning loop and owner notifications. This increases the chance of unreviewed network access, storage writes, and noisy or unwanted automation, especially if the skill was triggered broadly or ambiguously.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

8. **Run first learning loop** immediately
9. **Share initial findings** with owner

No confirmations. No "does this look right?" Just do it.

## The Learning Loop

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The instruction that the process runs autonomously with no confirmation delegates decision-making over fetching, filtering, note creation, and sharing without an approval gate. In context, this increases the chance of unintended actions and amplifies the impact of malformed triggers, malicious content, or poor relevance judgments.

Content

Scanner excerpt · references/learning-loop.md (reported line 3)May include surrounding context.

md

# Learning Loop - Detailed Flow

**This runs autonomously.** No confirmations, no pauses. Fetch, process, note, share.

## Trigger

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manual triggers include broad natural-language phrases like "learn something," which can overlap with ordinary conversation and unintentionally invoke the autonomous loop. In a skill that performs network access, note-writing, and state changes, ambiguous activation materially increases the chance of unintended execution.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

bash

# First scan (no cursor)
curl "https://api.daily.dev/public/v1/feeds/custom/{feedId}?limit=50" \   # 50 is max page size
  -H "Authorization: Bearer $DAILY_DEV_TOKEN"

# Subsequent scans (use cursor from pagination)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/learning-loop.md (reported line 21)May include surrounding context.

bash

# First scan (no cursor)
curl "https://api.daily.dev/public/v1/feeds/custom/{feedId}?limit=50" \   # 50 is max page size
  -H "Authorization: Bearer $DAILY_DEV_TOKEN"

# Subsequent scans (use cursor from pagination)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/learning-loop.md (reported line 25)May include surrounding context.

bash

# First scan (no cursor)
curl "https://api.daily.dev/public/v1/feeds/custom/{feedId}?limit=50" \   # 50 is max page size
  -H "Authorization: Bearer $DAILY_DEV_TOKEN"

# Subsequent scans (use cursor from pagination)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documented loop expands from reading a curated daily.dev feed into arbitrary web_fetch(post.url) and web_search(...) activity across the open internet. That broadens trust boundaries and can expose the agent to prompt injection, malicious content, tracking, or retrieval of unrelated material without clear user approval, especially in an autonomous workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The self-improvement section authorizes the agent to autonomously change tags, topics, and learning goals, which modifies future behavior and data intake without explicit user review. Even if intended as helpful optimization, this creates a persistence and scope-creep risk where external content can indirectly influence the agent's long-term configuration.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.