晨钟

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.0

Overview

This is a coherent local morning-briefing skill, but it should be reviewed because it asks to automatically process and retain private journals, session logs, and project memory without clear retention or minimization limits.

Install only if you are comfortable letting the skill read the specific local journals, logs, idea files, and project-memory files you configure. Prefer narrow file paths over broad directories, manually test before enabling scheduling, and avoid pointing it at folders that may contain secrets, client data, credentials, or unrelated private records.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:87

Finding

Continuous Collection and Retention of Sensitive Local Data Without Defined Minimization Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 87-92 and 132-151
Vulnerability Type: other: Sensitive Local Data Collection
Risk Level: Medium

The Skill directs the Agent to read personal journals, session logs, idea records, work logs, and project-memory files. It also describes extracting information after user interactions and retaining the results in a briefing data pool.

json

{
  "data_sources": {
    "daily_log": "path/to/your/daily/logs/",
    "session_log": "path/to/your/session/logs/",
    "idea_system": "path/to/your/idea/index.md",
    "journal_index": "path/to/your/journal/index.md",
    "project_memory": "path/to/your/project/memory.md"
  }
}

Technical Analysis

The configured sources can contain sensitive personal reflections, private conversations, project information, and inferred user priorities. The Skill describes both scheduled scans and automatic extraction following interactions, creating a persistent personal-data processing workflow rather than a limited, on-demand read.

Although the paths are configured by the user and the documentation states that data remains local, it does not specify:

• Retention periods for extracted information.
• Limits on the contents stored in the briefing data pool.
• Exclusion rules for secrets or unrelated sensitive records.
• Whether directory paths are scanned recursively.
• Controls preventing traversal outside explicitly authorized paths.
• Redaction of credentials, personal identifiers, or confidential project data.
• A verifiable deletion process beyond a general reset command.

No evidence of network transmission, remote exfiltration, privilege escalation, or access outside user-configured local sources was identified. The risk concerns overcollection, local persistence, and subsequent disclosure through generated briefings.

Attack Path

1. The user configures a journal, session-log, work-log, or proje ...[truncated 1472 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, per-source consent before reading journals, session logs, conversation records, or project memory.
2. Default to on-demand processing rather than automatic extraction after every interaction.
3. Restrict access to canonicalized, explicitly allowlisted files and directories.
4. Document whether directory scanning is recursive and disable recursion by default.
5. Reject path traversal, symbolic-link escapes, and files outside approved roots.
6. Apply file-type, file-size, and recency limits before processing content.
7. Detect and redact credentials, access tokens, personal identifiers, and other sensitive values before retention or briefing generation.
8. Store minimal derived summaries instead of complete source content.
9. Define configurable retention periods and automatically expire stale briefing-pool entries.
10. Provide a verifiable deletion function that removes stored summaries, indexes, and inferred priorities.
11. Preview the files and categories of information that will be processed before enabling scheduled execution.
12. Avoid displaying sensitive source paths or content in briefings unless the user explicitly enables that behavior.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill name and description are entirely in Chinese, but the manifest does not indicate that the skill is region-specific or that users can choose their preferred language. Under the policy, a language constraint without opt-in or clear justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example configuration sets "语言": "zh-CN" as the language, and the document otherwise presents the skill entirely in Chinese without describing any user-selectable language option. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.