Daily Diary

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:23 AM UTC
• Version: 1.0.0

Overview

This Chinese diary skill is mostly transparent, but it asks to process broad private history and profile files and includes an unsafe group-message delivery example for diary content.

Install only if you are comfortable with the agent reviewing your daily conversation history and potentially using persistent profile or memory files to match your writing style. Before enabling the cron example, change delivery to a private owner-only destination, avoid group chats, and require review before recurring automatic saving or sending.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:168

Finding

Excessive Access to Persistent Agent Identity and Memory Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 168; related conversation-history access at lines 14-22 and scope exception at line 181
Vulnerability Type: Excessive read privileges and privacy-boundary expansion
Risk Level: Medium

Relevant instruction, translated into English:

text

The Skill may read MEMORY.md, USER.md, SOUL.md, IDENTITY.md, and AGENTS.md
to understand the user's personality and writing style so that the diary
draft matches the user's tone. The original contents of these files must
not be copied directly into the diary.

Technical Analysis

The Skill permits access to persistent memory, user-profile, identity, personality, and Agent-configuration files. These files may contain private information, operational instructions, historical state, or unrelated contextual data. Reading every listed file is not required for the core operation of summarizing selected conversations into a diary.

The prohibition against directly copying the files reduces risk but does not prevent derived disclosure. Their contents can still influence generated summaries or be paraphrased into a diary entry. The Skill also scans all conversations from the current day, increasing the volume of information exposed to its filtering and summarization process.

This violates least-privilege principles because tone matching can be performed from the current conversation or from a narrowly scoped, user-approved style profile.

Attack Path

1. A scheduled or interactive diary run activates the Skill.
2. The Agent scans the day's conversations and reads one or more permitted persistent files.
3. A persistent file contains sensitive personal context, unrelated conversation details, or operational Agent instructions.
4. The model incorporates or paraphrases that information while generating the diary.
5. The generated content is stored under ~/diary/ or delivered through the configured messaging channe ...[truncated 726 chars]

Remediation

View remediation

Remediation Suggestions

• Default to the current conversation or to conversations explicitly selected by the user.
• Require explicit, informed consent before reading any persistent memory, identity, or Agent-configuration file.
• Replace broad file access with a dedicated, narrowly scoped diary-style profile containing only approved preferences.
• Do not read AGENTS.md, IDENTITY.md, or long-term memory merely for tone matching.
• Display the planned input sources before generation and allow the user to exclude individual sources.
• Apply field-level data minimization before content reaches the generation step rather than relying only on output filtering.
• Record which sources were used without recording their sensitive contents.
• Add tests confirming that diary generation works without access to persistent Agent-state files.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:127

Finding

Private Diary Content May Be Announced to a Group Messaging Destination

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 127-137
Vulnerability Type: Unsafe messaging-channel configuration example
Risk Level: Medium

Relevant configuration, with the message translated into English:

json

{
  "name": "daily-diary-zh",
  "schedule": {
    "expr": "0 20 * * *",
    "kind": "cron",
    "tz": "Asia/Shanghai"
  },
  "sessionTarget": "isolated",
  "payload": {
    "kind": "agentTurn",
    "message": "It is time for the evening diary. Review today's conversation records and generate a diary draft according to the daily-diary-zh workflow.",
    "timeoutSeconds": 180
  },
  "delivery": {
    "channel": "feishu",
    "mode": "announce",
    "to": "chat:<GROUP_ID>"
  }
}

Technical Analysis

The supplied scheduled-task example uses announcement mode and a group-chat destination for content derived from private conversation history. Diary entries are inherently sensitive, and delivery to a group is unsafe unless every recipient is explicitly authorized.

Later instructions state that drafts should be delivered only to the owner and not broadcast to unconfigured recipients. However, a configured group can still contain recipients other than the conversation owner. The Skill provides no recipient-membership validation, first-run confirmation, destination preview, or prohibition against group destinations.

Sensitive-data pattern filtering does not address this problem. Even after credentials and identifiers are removed, diary summaries can expose personal activities, decisions, challenges, plans, and emotional state.

Attack Path

1. A user or administrator copies the supplied cron configuration.
2. The placeholder is replaced with a real group-chat identifier.
3. The scheduled Agent run reads the day's private conversations.
4. The Agent generates a diary draft containing personal or work-related information.
5. Announcement-mode deli ...[truncated 819 chars]

Remediation

View remediation

Remediation Suggestions

• Change the example destination to a private direct-message channel owned by the diary user.
• Reject group-chat destinations by default.
• If group delivery is explicitly requested, show the resolved destination and require separate confirmation acknowledging that all group members will receive diary content.
• Verify recipient identity and current group membership before every delivery.
• Require user confirmation of the first generated draft before enabling recurring automatic delivery.
• Prefer sending a private notification that a local draft is ready rather than sending the diary body itself.
• Add an allowlist of approved recipient identifiers and fail closed if the destination cannot be verified.
• Pause delivery when group membership or channel ownership changes.
• Encrypt transport and avoid including sensitive diary content in delivery logs or scheduler metadata.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is explicitly named and described as a Chinese-version diary system, and the instructions throughout the file require Chinese-language interaction and output. The file does not offer a user language choice or indicate that Chinese is an opt-in preference, which violates the language/locale policy for natural-language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template headings and fixed status text are entirely in Chinese, which imposes a specific language/locale on generated diary content. Under the policy, forcing a language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The entire prompt library is written in Chinese and provides no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.