Briefing Room

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is coherent for generating macOS news briefings, but it uses public web/API sources, a short background sub-agent, and local file output/cleanup that users should notice.

This looks reasonable for a macOS daily briefing skill. Before installing, be aware that it will run a temporary background briefing task, query public web/API services, use your configured location for weather, and create files in the configured output folder. Use a coarse location if privacy matters and review the output folder before using cleanup.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

After asking for a briefing, work may continue in the background while collecting news and generating files.

Why it was flagged

The briefing is designed to run in a separate sub-agent for up to 10 minutes. This is aligned with the non-blocking briefing purpose and has a timeout/cleanup, but users should recognize it as background agent activity.

Skill content
Spawn a sub-agent with the full pipeline task immediately ... runTimeoutSeconds=600, cleanup="delete"
Recommendation

Only invoke the skill when you want a briefing generated, and keep the timeout/cleanup behavior in place.

What this means

Your configured location may be shared with public weather services when the briefing runs.

Why it was flagged

The helper sends configured latitude/longitude and timezone to a public weather API. This is expected for weather briefings and disclosed, but it is still privacy-relevant data flow.

Skill content
curl -s --max-time 10 "https://api.open-meteo.com/v1/forecast?latitude=$lat&longitude=$lon
Recommendation

Use a nearby city or coarse coordinates if you do not want precise location data used for weather.

What this means

Running the cleanup command can delete older generated briefing folders.

Why it was flagged

The helper includes a deletion command for old briefing output directories. It appears scoped to the configured briefing folder and is user-invoked, but deletion authority is worth noticing.

Skill content
clean       Remove briefings older than 30 days ... rm -rf "$dir"
Recommendation

Verify the configured output folder before using the clean command, especially if you changed output.folder.

What this means

The skill may not work as expected outside macOS or without the undeclared tools/capabilities.

Why it was flagged

The registry metadata declares only curl and no OS restriction, while the docs disclose additional runtime requirements. This is a dependency disclosure gap, not evidence of hidden behavior.

Skill content
Required: - macOS (uses `afplay`, `say`, `curl` — all built-in) - OpenClaw with `web_search`
Recommendation

Install only on macOS and confirm python3, afplay/say, curl, and web_search are available.