Security audit

Daily Planner

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent daily planner, but it asks agents to automatically store, change, and share sensitive planning data without clear user consent or boundaries.

Review this skill before installing. It is not showing malware or hidden code, but you should only use it with explicit controls for calendar writes, email access, partner sharing, notification changes, and local storage. Avoid enabling automatic commitment logging or calendar synchronization until you know where data is stored, who can see shared summaries, and how to delete archives.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:17
Finding: Unprotected Storage of Sensitive Conversation and Planning Data## Vulnerability Details **File Location**: `SKILL.md:17-23`, `SKILL.md:82-87`, `tracking.md:3-20`, `tracking.md:23-25`, `tracking.md:105-111` **Vulnerability Type**: Plaintext storage of sensitive data without defined access controls, consent, or retention safeguards **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:17-23`: ```markdown ## Storage Data stored in `~/planner/`: - **config** — Profile, energy windows, constraints - **today** — Current day plan (regenerated daily) - **commitments** — Open commitments and follow-ups - **weekly** — Week overview with deadlines - **archive/** — Past plans for patterns ``` `SKILL.md:82-87`: ```markdown Every promise made = logged automatically: - Extract from conversations: "I'll send you X by Y" - Add to commitments file with deadline - Remind before deadline (configurable: 24h, 48h) - Flag overdue until resolved ``` `tracking.md:3-20`: ```markdown ## What Gets Tracked Every promise or commitment made in conversation: **Trigger phrases:** - "I'll send you..." - "Let me get back to you..." - "I'll check on that..." - "I promised to..." - "Can you remind me to..." - "I need to tell X about Y" **Extracted data:** | Field | Example | |-------|---------| | What | Send proposal | | To whom | Client X | | By when | Friday 5pm | | Context | Follow-up to meeting | ``` `tracking.md:23-25`: ```markdown ## Storage Format In `~/planner/commitments`: ``` `tracking.md:105-111`: ```markdown **Metrics to monitor:** - How many commitments made per week - What % completed on time - What topics keep getting pushed (pattern) - Who you make most commitments to **Weekly insight:** ``` ### Technical Analysis The Skill directs the Agent to automatically extract and persist information from conversations, including names, relationships, commitments, deadlines, meeting context, behavioral patterns, cale ...[truncated 2602 chars]
Remediation: ## Remediation Suggestions 1. Require explicit opt-in before persisting information extracted from conversations. Present the proposed entry and obtain confirmation before writing it. 2. Apply data minimization. Store only the task and deadline by default; omit names, meeting context, message content, and relationship details unless strictly necessary. 3. Create `~/planner/` with owner-only permissions (`0700`) and each data file with owner read/write permissions (`0600`). Refuse to continue if permissions are broader and cannot be corrected safely. 4. Use operating-system protected encrypted storage or application-level authenticated encryption for sensitive records. Keep encryption keys outside the planner files and archives. 5. Define configurable retention limits. Automatically delete completed commitments and archived plans after the selected period rather than retaining them indefinitely. 6. Provide commands to inspect, export, redact, and permanently delete individual records or all stored data. 7. Allow users to mark conversations or entries as non-persistent and exclude sensitive categories from automatic extraction. 8. Avoid placing sensitive context in reminders, notifications, automatic replies, or shared summaries unless the user explicitly approves the recipient and content. 9. Document whether files may be included in cloud backups or synchronization services and provide a supported mechanism to exclude them. 10. Add tests verifying restrictive permissions, consent enforcement, retention behavior, deletion, redaction, and prevention of accidental sensitive-data logging.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly stores sensitive personal planning data in ~/planner/, including current day plans, commitments, deadlines, and archived history, but provides no user-facing notice, consent, retention policy, or guidance about local persistence. This creates privacy risk because highly personal behavioral and schedule data may be collected and retained without the user realizing it, and local files may later be exposed to other users, backups, malware, or shared machines.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill says promises will be 'logged automatically' by extracting commitments from conversations, but it does not warn the user that conversational content will be parsed and persisted as structured records. In this context, conversations can contain sensitive work, family, academic, or client obligations, so silent extraction increases the chance of collecting private information the user did not intend to store.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to automatically block calendar time when it finds an open window, which is a state-changing action on the user's calendar without explicit confirmation or a warning that the calendar will be modified. In a calendar-management skill this behavior is contextually plausible, but it is still risky because it can create unwanted events, override user preferences, and cause scheduling errors if the agent acts on incomplete or stale calendar data.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill describes automatically pausing notifications and enabling an auto-reply during deep work, both of which change system and communication behavior without an explicit warning or consent checkpoint. Even in a productivity skill, these actions can cause missed urgent messages, confuse contacts, and create privacy or operational issues if the auto-reply exposes availability patterns or is activated unexpectedly.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The guidance says to unify work, school, medical, and family calendars automatically and block family events in the work calendar, but it omits any privacy warning, data-minimization rule, or consent boundary for especially sensitive information. Combining these sources can expose medical, family, and personal data into broader workplace-visible systems or across accounts, increasing the risk of accidental disclosure and over-sharing.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The Parent Profile instructs the agent to share a daily summary with a partner and react to partner-added events, but it does not require explicit user consent, scoping, or confirmation before disclosing potentially sensitive schedule details. Because planning data can include work commitments, children-related logistics, and medical appointments, automatic sharing creates a real privacy and confidentiality risk if enabled by default or used with the wrong recipient/account.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly includes emails flagged as "needs decision" as an input source, but it provides no user-facing notice, consent flow, or data-minimization guidance for accessing potentially sensitive email content. In a daily planner context, this increases the chance of over-collection or unexpected processing of private communications, which could expose confidential personal or business information.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The phrase "When user asks \"plan my day\" or triggered automatically" combines a common everyday utterance with an unspecified automatic activation condition. The file does not define constraints, scope, or exclusion conditions for when the routine should auto-run, making invocation boundaries ambiguous.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill specifies automatic extraction and persistent storage of commitments, recipients, deadlines, and contextual conversation details in a local file without any explicit user notice, consent, retention limit, or access control guidance. This creates a privacy risk because sensitive interpersonal, business, or scheduling data can be silently accumulated over time and later exposed to other local users, processes, backups, or logs.

Natural-Language Policy Violations

Low

Confidence: 80% confidence
Finding: The markdown presents default time-based productivity assumptions such as '8-11 AM' high energy for 'most people' before obtaining user preference. This can be read as forcing a specific workday/locale pattern rather than offering it as an optional example first.

Static analysis

No suspicious patterns detected.