Morning Intelligence

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:05 AM UTC
• Version: 50.0.0

Overview

The skill is a legitimate daily-briefing prompt builder, but its setup guidance may cause users to commit sensitive personal or business context to Git without adequate warning.

Review the generated master prompt for confidential role, company, deal, product, regulatory, or source information before saving it. Prefer a private repository or ignored local routine file, and avoid committing sensitive tracking priorities into Git history.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:134

Finding

Potential Disclosure of Sensitive User Context Through Git

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:134, 169–171
Vulnerability Type: Sensitive information exposure through insecure configuration guidance
Risk Level: Medium

Vulnerable Code Snippet

text

CURRENTLY TRACKING THIS WEEK
[Specific story / company / topic the user flagged]

text

2. Add a new routine with a cron schedule (e.g. "0 7 * * *" for 7 AM daily)
3. Set the prompt field to the master prompt above
4. Commit and push — Claude Code will run it on schedule.

Technical Analysis

The skill generates a master prompt containing user-specific information, potentially including the user's role, preferred sources, exclusions, business interests, and companies, deals, products, or regulatory developments currently being tracked.

The setup guide directs the user to place this generated prompt in .claude/routines.json, then commit and push it. It does not instruct the user to inspect the prompt for sensitive information, confirm that the target repository is private, or store confidential values outside version control.

Git commits retain historical content even after a later working-tree deletion. Consequently, following these instructions in a public or broadly shared repository can persistently expose the generated profile and business context. This is not covert exfiltration: exploitation depends on the user following the documented setup guidance and pushing to a repository accessible to unauthorized parties.

Attack Path

1. A user answers the interview with personal or confidential business context.
2. The skill incorporates those answers into the generated master prompt, including current tracking priorities.
3. The user stores the prompt in .claude/routines.json as instructed.
4. The user commits and pushes the file without redacting sensitive content or checking repository visibility.
5. An unauthorized party with access to the public or shared repository reads the committed prompt or retrieves it from ...[truncated 726 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unconditional “Commit and push” instruction with a warning to review the generated prompt for confidential or identifying information before storing it.
2. Require users to verify that the repository is private and that access is limited to intended recipients before pushing.
3. Recommend keeping personalized prompts in an ignored local configuration file rather than a tracked file.
4. Where supported, store sensitive prompt sections in an approved secret manager or inject them through protected environment variables.
5. Provide a sanitized routine template containing placeholders while keeping user-specific values outside version control.
6. Add .claude/routines.json, or a separate sensitive override file, to .gitignore when cloud synchronization through Git is unnecessary.
7. Warn that deleting sensitive content in a later commit does not remove it from Git history. If exposure occurs, instruct users to rewrite repository history, invalidate affected forks or caches where possible, and review repository access logs.
8. Add a pre-commit review step or automated secret/sensitive-data scanning before allowing generated briefing configurations to be committed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.