Security audit

Morning Briefing

Security checks for vulnerabilities and agentic risk

Overview

This morning-briefing skill is purpose-aligned, but users should understand that its intended Notion integration uses a local API key and can read personal task data.

Install only if you are comfortable with the skill reading reminder data, using a Notion API key from your local config, querying the configured Notion tasks database, and writing a briefing note to your vault. Use a narrowly scoped Notion token and a dedicated tasks database where possible.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README advertises broad natural-language triggers such as "Morning briefing" and "Daily report for 2026-01-28" without any clear activation boundary, confirmation step, or parameter restrictions. Because the documented trigger chain includes remindctl, a Notion query, and vault_add_note, ambiguous invocation could cause unintended data retrieval or note creation when a user's casual phrasing matches these examples.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: The hardcoded external endpoint indicates the skill sends data to a third-party network location. In context this is likely intended functionality rather than exfiltration, but it remains a real risk because the skill has network egress and authenticated access to user task data without any built-in warning or policy enforcement.
Content: Scanner excerpt · scripts/generate-briefing.sh (reported line 1)May include surrounding context.
sh
#!/bin/bash\nset -e\n\ndate=${1:-$(date +%Y-%m-%d)}\nnotion_db=${NOTION_TASKS_DB:-}\n\ncat << EOF\n📅 Morning Briefing for ${date}\n\n⏰ REMINDERS (Today)\nEOF\n\nremindctl today --plain | awk -F'\\t' '{print " " substr(\$1,1,8) " - " \$5}' || echo " No reminders"\n\necho\n\necho 📝 NOTION TASKS\necho\n\nif [ -n "$notion_db" ]; then\n NOTION_KEY=\\$(cat ~/.config/notion/api_key)\n curl -s -X POST "https://api.notion.com/v1/databases/$notion_db/query" \\\n -H "Authorization: Bearer \\$NOTION_KEY" \\\n -H "Notion-Version: 2022-06-28" \\\n -H "Content-Type: application/json" \\\n -d '{\"filter\": {\"property\": \"Status\", \"select\": {\"does_not_equal\": \"Done\"}}}' | \\\n jq -r '.results[] | \" [ ] \" + (.properties.Name.title[0].plain_text // "Untitled")'\nelse\n echo " Set NOTION_TASKS_DB env or specify DB ID"\nfi\n\n# Output to stdout for Clawdbot to capture/use\n

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: The hardcoded external endpoint indicates the skill sends data to a third-party network location. In context this is likely intended functionality rather than exfiltration, but it remains a real risk because the skill has network egress and authenticated access to user task data without any built-in warning or policy enforcement.
Content: Scanner excerpt · scripts/generate-briefing.sh (reported line 1)May include surrounding context.
sh
#!/bin/bash\nset -e\n\ndate=${1:-$(date +%Y-%m-%d)}\nnotion_db=${NOTION_TASKS_DB:-}\n\ncat << EOF\n📅 Morning Briefing for ${date}\n\n⏰ REMINDERS (Today)\nEOF\n\nremindctl today --plain | awk -F'\\t' '{print " " substr(\$1,1,8) " - " \$5}' || echo " No reminders"\n\necho\n\necho 📝 NOTION TASKS\necho\n\nif [ -n "$notion_db" ]; then\n NOTION_KEY=\\$(cat ~/.config/notion/api_key)\n curl -s -X POST "https://api.notion.com/v1/databases/$notion_db/query" \\\n -H "Authorization: Bearer \\$NOTION_KEY" \\\n -H "Notion-Version: 2022-06-28" \\\n -H "Content-Type: application/json" \\\n -d '{\"filter\": {\"property\": \"Status\", \"select\": {\"does_not_equal\": \"Done\"}}}' | \\\n jq -r '.results[] | \" [ ] \" + (.properties.Name.title[0].plain_text // "Untitled")'\nelse\n echo " Set NOTION_TASKS_DB env or specify DB ID"\nfi\n\n# Output to stdout for Clawdbot to capture/use\n

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script silently reads a local API key and uses it in an authenticated HTTP request, with no user-facing warning that a local secret will be accessed or that data will be sent to a third-party service. In an agent/skill setting, this can surprise users, violate least astonishment, and enable unintended disclosure of task metadata to an external platform.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script reads a local Notion API key from the user's home directory and transmits it to an external service as part of an authenticated API request. While this appears functionally related to fetching Notion tasks for the briefing, it still introduces credential use and outbound network access without any explicit disclosure, consent, or guardrails, which is risky in an agent skill context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.