Daily Report Public

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:33 AM UTC
• Version: 1.0.0

Overview

This daily-report skill is useful and coherent, but it can read memory, conversation history, and project files, then write summaries back to memory without clear user confirmation.

Review this skill before installing if you use agent memory or keep sensitive information in project files. It should ideally ask before reading broader context and before saving any generated report back to memory.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:42

Finding

Overbroad Access to Persistent Memory and Conversation History

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42–46 and 78
Vulnerability Type: Excessive access to persistent user context
Risk Level: Medium

Vulnerable Code

markdown

## Data Sources

When generating a daily report, check these sources:

1. **Today's memory file** (`memory/YYYY-MM-DD.md`) - Primary source for today's tasks
2. **Yesterday's memory file** (`memory/YYYY-MM-DD.md`) - For carryover context
3. **Recent conversation history** - If needed for clarification
4. **Project files** (e.g., TODO.md, PROJECTS.md) - If relevant

markdown

- Update memory files with the generated report for future reference

Technical Analysis

The skill directs the agent to access persistent memory files, recent conversation history, and potentially broad project files without requiring explicit consent for each source or defining strict relevance and data-minimization boundaries. These sources may contain credentials, personal information, confidential project details, or unrelated conversation content.

The instruction to update memory files creates an additional persistence concern. Generated reports may contain sensitive, inaccurate, or user-supplied content that is retained across sessions. The documented behavior does not explicitly direct the agent to store attacker-controlled rules, so this is not confirmed memory poisoning; however, unrestricted persistence increases exposure if report content is later treated as trusted context.

No external transmission, arbitrary code execution, permission escalation mechanism, or malicious payload was identified. Exploitation is limited to the files and conversation context that the hosting agent is already authorized to access.

Attack Path

1. A user or untrusted participant places sensitive, misleading, or specially crafted content in a daily memory file, recent conversation, or relevant project file.
2. The user invokes the daily-report skill.
3. Following the skill instruction ...[truncated 1417 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user consent before reading persistent memory or conversation history.
2. Default to information supplied directly in the current request and only access additional sources when necessary.
3. Restrict file access to the exact requested dates and explicitly approved project files.
4. Define relevance filtering so unrelated conversations, tasks, and projects are excluded.
5. Detect and redact credentials, access tokens, personal information, and other sensitive data before generating or persisting a report.
6. Treat all content loaded from memory, conversations, and project files as untrusted data rather than executable instructions.
7. Present the generated report to the user for review and obtain confirmation before writing it to persistent memory.
8. Allow users to disable persistence or select a dedicated report file that is isolated from general agent memory.
9. Record which sources were consulted so users can verify the report's provenance.
10. Apply host-level least-privilege controls so the skill can access only approved memory and project paths.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description mixes several broad use cases such as daily reports, status summaries, and tracking pending work without clearly defining boundaries. That ambiguity increases the chance of this skill being selected for general productivity queries, leading it to access memory or project files outside the user's specific expectation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The report template headings are entirely in Chinese and the trigger phrases emphasize Chinese terms, but the file does not state that this is a China-specific skill or offer the user a language/locale option. That can conflict with language-choice policy when users may expect output in their own language.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list is broad enough to match generic requests like status summaries or 'what did you do today,' which can cause the skill to activate in contexts the user did not specifically intend. In a skill that reads memory files and may later write report data back to memory, unintended invocation can expose or process more personal/project context than necessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs updating memory files with the generated report but does not disclose that persistent data will be modified or require user consent. Silent writes create integrity and privacy risks because the system may store inaccurate summaries, sensitive details, or unwanted records in long-lived memory.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.