Morning Briefing Litiao

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:50 AM UTC
• Version: 1.0.0

Overview

This morning-briefing skill has a coherent purpose, but it reads personal reminder/task data and a local Notion API key with weak disclosure and broad activation wording.

Review before installing. Only use this if you are comfortable letting the skill read your reminders, query a configured Notion tasks database, use a local Notion API key, and potentially write briefing content to a vault; prefer adding explicit confirmation and documented credential configuration first.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README describes broad natural-language triggers such as 'Morning briefing' and 'Daily report for 2026-01-28' plus chained actions ('remindctl today + Notion query + vault_add_note') without stating explicit activation boundaries, confirmation requirements, or input constraints. This ambiguity can cause unintended invocation or overbroad execution of connected capabilities, especially where external data sources and note-writing actions are involved.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation description includes broad, everyday phrases like 'daily summary' and 'today's plan' that can match common user requests and trigger the skill unintentionally. Because this skill accesses personal reminder and Notion task data, accidental invocation could expose or process sensitive personal information without the user clearly intending to use this specific skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description states that the skill pulls data from Apple Reminders and a Notion tasks database, but it does not warn users that personal task and reminder data will be accessed. In a skill handling productivity and reminder content, the absence of a clear disclosure increases the risk of users unknowingly exposing sensitive schedules, tasks, or personal notes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The heading 'When to Read' followed by the broad trigger 'Customizing briefing' does not clearly define when this skill should or should not be used. It lacks specific trigger phrases, constraints, or exclusion examples, so the invocation scope is ambiguous.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

The hardcoded Notion API domain confirms that the skill communicates with an external service. This is less severe than arbitrary or attacker-controlled exfiltration because the destination is a legitimate vendor endpoint, but it still matters in an agent skill when network activity is not clearly declared or constrained.

Content

Scanner excerpt · scripts/generate-briefing.sh (reported line 1)May include surrounding context.

sh

#!/bin/bash\nset -e\n\ndate=${1:-$(date +%Y-%m-%d)}\nnotion_db=${NOTION_TASKS_DB:-}\n\ncat << EOF\n📅 Morning Briefing for ${date}\n\n⏰ REMINDERS (Today)\nEOF\n\nremindctl today --plain | awk -F'\\t' '{print "  " substr(\$1,1,8) " - " \$5}' || echo "  No reminders"\n\necho\n\necho 📝 NOTION TASKS\necho\n\nif [ -n "$notion_db" ]; then\n  NOTION_KEY=\\$(cat ~/.config/notion/api_key)\n  curl -s -X POST "https://api.notion.com/v1/databases/$notion_db/query" \\\n    -H "Authorization: Bearer \\$NOTION_KEY" \\\n    -H "Notion-Version: 2022-06-28" \\\n    -H "Content-Type: application/json" \\\n    -d '{\"filter\": {\"property\": \"Status\", \"select\": {\"does_not_equal\": \"Done\"}}}' | \\\n  jq -r '.results[] | \"  [ ] \" + (.properties.Name.title[0].plain_text // "Untitled")'\nelse\n  echo "  Set NOTION_TASKS_DB env or specify DB ID"\nfi\n\n# Output to stdout for Clawdbot to capture/use\n

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 68% confidence

Finding

The hardcoded Notion API domain confirms that the skill communicates with an external service. This is less severe than arbitrary or attacker-controlled exfiltration because the destination is a legitimate vendor endpoint, but it still matters in an agent skill when network activity is not clearly declared or constrained.

Content

Scanner excerpt · scripts/generate-briefing.sh (reported line 1)May include surrounding context.

sh

#!/bin/bash\nset -e\n\ndate=${1:-$(date +%Y-%m-%d)}\nnotion_db=${NOTION_TASKS_DB:-}\n\ncat << EOF\n📅 Morning Briefing for ${date}\n\n⏰ REMINDERS (Today)\nEOF\n\nremindctl today --plain | awk -F'\\t' '{print "  " substr(\$1,1,8) " - " \$5}' || echo "  No reminders"\n\necho\n\necho 📝 NOTION TASKS\necho\n\nif [ -n "$notion_db" ]; then\n  NOTION_KEY=\\$(cat ~/.config/notion/api_key)\n  curl -s -X POST "https://api.notion.com/v1/databases/$notion_db/query" \\\n    -H "Authorization: Bearer \\$NOTION_KEY" \\\n    -H "Notion-Version: 2022-06-28" \\\n    -H "Content-Type: application/json" \\\n    -d '{\"filter\": {\"property\": \"Status\", \"select\": {\"does_not_equal\": \"Done\"}}}' | \\\n  jq -r '.results[] | \"  [ ] \" + (.properties.Name.title[0].plain_text // "Untitled")'\nelse\n  echo "  Set NOTION_TASKS_DB env or specify DB ID"\nfi\n\n# Output to stdout for Clawdbot to capture/use\n

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script reads a local Notion API key from disk and uses it to make an external network request, but there is no manifest, prompt, or disclosure indicating that the skill will access local credentials and contact a third-party service. Even if the purpose is legitimate, undisclosed credential use and outbound transmission increase the risk of unauthorized data access or surprising data exfiltration in an agent skill context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script silently loads ~/.config/notion/api_key and sends it as a bearer token in an HTTP request without notifying the user at runtime. In a skill ecosystem, silent use of locally stored secrets is dangerous because users may not realize the skill accesses their private integrations and remote task data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.