Morning Coffee Briefing

Daily morning briefing skill. Reads your TASKS.md and memory files, synthesizes a prioritized day plan, and sends it to you via Telegram so you start the day...

Security Scan

The skill's stated purpose (read tasks, synthesize a short briefing, send via Telegram) is plausible, but there are mismatches and vague instructions that could cause the agent to read broad personal memory files and perform undeclared checks (pipelines), so you should review and constrain what it can access before installing.

Purpose & Capability

The name/description match the runtime instructions (read TASKS.md and memory files, send a Telegram message). However the registry metadata provided with the skill says there are no required env vars or config paths, while the SKILL.md explicitly requires TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID, and TASKS_FILE_PATH — a clear metadata/instruction mismatch. The skill also references {MEMORY_DIR} (not declared) and asks to check 'pipeline status' (no credentials or endpoints declared), which is beyond the minimal needs described.

Instruction Scope

SKILL.md instructs the agent to read TASKS.md plus 'any memory files' (MEMORY.md, projects.md, recent notes) and to 'check pipelines' — these are vague and could cause the agent to read many personal files or attempt network calls requiring other credentials. Allowed tools include Read, Bash, Glob, Grep, and WebSearch; Bash + Glob + Grep increase the risk that the agent could read or enumerate more files than intended or run shell commands. The Telegram send step is explicit and expected; the rest (memory access and pipeline checks) needs tighter scoping.

Install Mechanism

No install spec and no code files — the skill is instruction-only. That minimizes disk-written code and installer risk.

Credentials

The SKILL.md requires TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID, and TASKS_FILE_PATH — these are proportionate for sending messages and locating the tasks file. However the skill also references {MEMORY_DIR} (undeclared) and asks to check pipeline status without declaring any supporting credentials or endpoints. Registry metadata did not list the declared env vars, which is an inconsistency that could hide required secrets from reviewers.

Persistence & Privilege

always is false and the skill is user-invocable; it does recommend scheduling with cron but does not request system-wide persistence or modify other skills' configs. Autonomous invocation is allowed (platform default) but not combined here with other severe red flags.

What to consider before installing

This skill does what it says — read your tasks and send a Telegram briefing — but there are a few red flags you should address before installing: 1) Confirm and add the required environment variables to the registry metadata (TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID, TASKS_FILE_PATH) so reviewers and your agent know what secrets are required. 2) Clarify {MEMORY_DIR} and limit exactly which memory files the skill is allowed to read (avoid open-ended 'any memory files' or globs that could expose sensitive data). 3) Remove or explicitly define the 'pipeline status' checks (what services, what credentials, and what endpoints) — otherwise the agent might attempt network calls or require other tokens. 4) Consider removing Bash/Glob/Grep from allowed tools or restrict file read operations to an explicit whitelist to prevent accidental file enumeration or arbitrary shell execution. 5) Test with a throwaway Telegram bot and a sandboxed TASKS.md/memory directory containing non-sensitive data to confirm behavior. If you cannot get explicit metadata for the memory paths and pipeline checks, treat this skill as higher risk and do not grant it access to real personal or production data.

Morning Coffee — Daily Briefing Skill

Sends you a punchy morning briefing via Telegram so you wake up knowing exactly what move to make first.

Setup

Set these environment variables (or hardcode paths in the skill):

• TELEGRAM_BOT_TOKEN — your Telegram bot token from @BotFather
• TELEGRAM_CHAT_ID — your Telegram chat ID
• TASKS_FILE_PATH — path to your TASKS.md (e.g., ~/.clawd-cc/memory/TASKS.md)

What It Does

1. Reads your TASKS.md for pending items
2. Reads any memory files (MEMORY.md, projects.md, recent notes)
3. Checks for any urgent blockers or time-sensitive items
4. Synthesizes the top 3 priorities for today
5. Sends a punchy Telegram message you can act on immediately

Process

Step 1: Load Context

Read all context files in parallel:

• $TASKS_FILE_PATH — pending tasks
• {MEMORY_DIR}/MEMORY.md — long-term context
• {MEMORY_DIR}/projects.md — active projects (if exists)

Step 2: Analyze Priorities

Identify:

• Top 3 tasks for today — what moves the needle most
• One quick win — something completable in <30 min to build momentum
• One blocker — anything that needs Kevin's direct input (flag these)
• Pipeline status — check any automated pipelines (revenue, posts, etc.)

Step 3: Compose the Briefing

Format (punchy, max 400 chars):

Good morning! Here's your plan:

1. [Highest priority task — 1 line]
2. [Second priority — 1 line]
3. [Third priority — 1 line]

Quick win: [easiest task to knock out]
Watch out: [any blocker or time-sensitive item]

[Pipeline status in 1 line if relevant]

Step 4: Send via Telegram

curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
  -H "Content-Type: application/json" \
  -d "{\"chat_id\": \"${TELEGRAM_CHAT_ID}\", \"text\": \"[MESSAGE]\"}"

Scheduling

Add to your cron (runs at 7 AM daily):

0 7 * * * claude -p "/morning-coffee-briefing"

Or use your agent's built-in cron scheduler.

Customization

Modify Step 2 to match your setup:

• Change the memory file paths to match your project structure
• Add pipeline status checks specific to your automation (YouTube, Upwork, etc.)
• Adjust the Telegram format to your preference