Morning Briefing Generator 晨会简报生成器

• Outcome: Review
• Latest audit: May 29, 2026 at 9:33 PM UTC
• Version:
  1.0.0

Overview

This daily briefing skill is plausible, but it needs review because it enables recurring scheduled output while its safety claims and package contents are inconsistent.

Install only if you deliberately want a recurring briefing workflow. Before enabling scheduling, confirm the exact time, timezone, destination, output path, and how to disable it; treat the included security report cautiously because it references a script that is not present in the package.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The README exposes broad natural-language invocations such as generating a briefing or scheduling one daily without defining clear trigger boundaries, confirmation requirements, or scope constraints. In an agent setting, this can cause unintended execution or overbroad task activation, especially for scheduled actions that may repeatedly run and write files without explicit user confirmation.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger examples allow users to enable recurring generation and pushing with very broad natural-language phrasing, but the skill does not define clear consent, confirmation, scope, or destination constraints for scheduled behavior. In an agent environment, ambiguous scheduling and push actions can lead to persistent autonomous activity, repeated workspace writes, or unintended notifications being set up from a casual request.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill advertises file output and timed automatic execution, but its user-facing description does not clearly warn that it may write artifacts into the workspace and continue running on a schedule after initial setup. This can mislead users about ongoing side effects, increasing the risk of unwanted file creation, clutter, or persistent automated actions they did not fully intend to authorize.

VirusTotal

65/65 vendors flagged this skill as clean.