Daily Recap

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:08 AM UTC
• Version: 1.0.0

Overview

This daily recap skill is understandable, but it can automatically read and persist private agent activity and potentially broad Discord messages without clear scoping or consent controls.

Review this skill carefully before installing. It should be limited to specific memory files and approved Discord channels, Discord scanning should be opt-in, and recap generation should redact secrets or private details before writing to Obsidian or memory, especially if run from cron.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:13

Finding

Overbroad Access to Agent Memory and Discord Communications

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–14
Vulnerability Type: Excessive access to private memory and unspecified Discord guild channels
Risk Level: Medium

Complete Vulnerable Snippet:

markdown

1. **Read today's memory log**: `memory/YYYY-MM-DD.md` (use today's date)
2. **Read recent Discord messages** (optional): scan the guild channels for today's messages if memory log is sparse

Technical Analysis

The skill directs the agent to read its daily memory and, when that log is considered sparse, scan unspecified Discord guild channels. The phrase “scan the guild channels” does not impose a guild or channel allowlist, verify that the recap requester is authorized to access the messages, limit collection to relevant conversations, or require filtering of credentials and other sensitive content.

This behavior violates least-privilege principles because a daily recap can ordinarily be generated from the designated memory log. Broadening collection to every accessible guild channel may expose unrelated communications to the recap process. The gathered material is subsequently summarized and stored persistently in an Obsidian journal, potentially duplicating sensitive information into a location with different access controls.

Attack Path

1. An authorized automation or user triggers the daily recap skill.
2. The skill reads memory/YYYY-MM-DD.md.
3. The agent determines that the memory log is sparse.
4. Following the skill instructions, the agent scans all accessible Discord guild channels for messages from that day.
5. It encounters unrelated private information, personal data, credentials, internal discussions, or content belonging to users outside the recap's intended scope.
6. The agent incorporates some of that information into the recap.
7. The recap is persisted at vault/daily-recap/YYYY-MM-DD.md, making the improperly collected content available to anyone or any process with access to that vault.

No ...[truncated 929 chars]

Remediation

View remediation

Remediation Suggestions

1. Make Discord collection disabled by default and require explicit approval for each recap run.
2. Define an allowlist of authorized guild and channel identifiers rather than scanning all accessible channels.
3. Restrict queries to the applicable date, requesting identity, and recap-related conversations.
4. Verify that the requesting user is authorized to summarize content from each selected channel.
5. Apply least privilege to the Discord integration so it can read only channels required for recap generation.
6. Add filtering for credentials, authentication tokens, personal data, private messages, and other sensitive content before creating the journal entry.
7. Record source references and collection boundaries so users can review what was accessed.
8. If the memory log is missing or sparse, default to the documented “No activity logged” behavior instead of automatically expanding data collection.
9. Apply restrictive access controls and retention policies to vault/daily-recap/ because recap files may contain sensitive operational information.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly aggregates user requests, research activity, created artifacts, and optionally recent Discord messages into a plain-language Obsidian journal entry, then persists that summary and updates memory logs. This creates a real data leakage risk because sensitive prompts, internal research, secrets mentioned in chat, or operational details can be copied into durable notes outside their original context, especially during unattended nightly runs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill performs potentially privacy-sensitive actions—reading today's memory log, optionally scanning Discord messages, writing a recap file, and appending to memory—without an explicit user-facing warning or consent boundary in the skill description. Because it is also designed for silent cron execution, users may not realize their messages and requests are being aggregated and persisted automatically, increasing the risk of unexpected data collection and retention.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.