ai-daily-briefing

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:20 AM UTC
• Version: 1.0.0

Overview

This is a normal daily briefing skill, but it should be reviewed because broad everyday requests can cause it to pull private task, calendar, meeting, and memory context.

Install only if you are comfortable with the assistant using workspace to-dos, recent meeting notes, calendar details, and optional memory/user files in briefings. Prefer explicit requests like 'daily briefing' and avoid storing secrets or unrelated sensitive facts in files this skill may read.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:129

Finding

Overbroad Access to Persistent User and Agent Context

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:129-136 and SKILL.md:170-179
Vulnerability Type: Excessive access to persistent memory and user-profile files
Risk Level: Medium

Vulnerable Code

SKILL.md:129-136:

markdown

### 4. Memory/Context Files (if using ai-persona-os)

**Locations:**
- `MEMORY.md` — Permanent facts
- `memory/[today].md` — Session notes
- `USER.md` — User preferences

SKILL.md:170-179:

markdown

### Step 1: Gather Data Sources

Check for these files in order:

1. todo.md (to-do list from ai-meeting-notes)
2. meeting-notes/ folder (recent meeting notes)
3. MEMORY.md (if using ai-persona-os)
4. memory/[today].md (session notes)
5. Calendar integration (if available)

text

Technical Analysis

The Skill instructs the agent to inspect persistent memory and current-session notes whenever it generates a briefing. Persistent files such as MEMORY.md and memory/[today].md may contain personal facts, confidential context, or information unrelated to task and calendar summarization.

The instructions do not require explicit user consent before accessing these files, restrict reads to briefing-relevant fields, or prohibit the inclusion of credentials and unrelated sensitive information. This violates least-privilege principles because a daily briefing can normally be generated from narrower sources such as todo.md, recent meeting notes, and an explicitly authorized calendar.

The Skill does not contain network transmission logic, executable payloads, or credential-stealing code. The primary risk is unintended disclosure into the active conversation rather than external exfiltration.

Attack Path

1. Persistent memory or session files contain private information unrelated to the requested briefing.
2. The user asks for a daily briefing using one of the Skill's trigger phrases.
3. The agent follows the data-gathering instructions and re ...[truncated 1108 chars]

Remediation

View remediation

Remediation Suggestions

1. Make persistent-memory access explicitly opt-in and disabled by default.
2. Use todo.md, recent meeting notes, and an explicitly authorized calendar as the default briefing sources.
3. Ask for user confirmation before reading MEMORY.md, USER.md, or session-history files.
4. Allow users to approve individual files or narrowly defined data categories rather than granting blanket access to memory storage.
5. Apply data minimization: extract only task deadlines, meeting decisions, and briefing-relevant preferences.
6. Add explicit instructions never to reproduce credentials, API keys, authentication tokens, financial details, health information, or unrelated personal facts.
7. Filter generated context before output and redact values that resemble secrets or sensitive identifiers.
8. Document which sources were consulted so users can verify and revoke access.
9. Separate durable preferences from general memory by using a dedicated, narrowly scoped briefing-preferences file.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad conversational phrases like "what do I need to know?" and "give me the rundown," which can match ordinary user language and invoke the skill unexpectedly. In a skill that aggregates potentially sensitive data from todo files, meeting notes, memory files, and calendar context, accidental activation can cause over-broad disclosure of private work context in situations where the user did not explicitly request a briefing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example uses the single word "briefing" as a generic activation phrase with no namespace, opt-in context, or exclusion rules. In assistant ecosystems where skills may activate from natural language, such a broad trigger can cause accidental invocation during ordinary conversation, potentially surfacing private calendar, task, or meeting-note data unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger example "what's today look like?" is highly conversational and overlaps with common chat requests unrelated to this skill. That ambiguity increases the chance the skill activates unintentionally and retrieves or summarizes sensitive productivity data when the user did not mean to invoke it.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The phrase "what's overdue?" is broad and can easily occur in ordinary discussion about tasks, billing, or other domains. In this skill's context, accidental matching could reveal overdue work items and associated business details from integrated to-do or meeting-note sources without sufficiently clear intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example trigger phrases include very broad, natural-language requests such as "what's on my plate?" and "start my day," which can plausibly appear in ordinary conversation and cause accidental invocation. In a skill that aggregates task, calendar, and meeting context, unintended activation can expose sensitive productivity data or cause the agent to act on the wrong intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The quick-start text says to-do items and calendar details populate automatically, but it does not warn users that personal tasks, meetings, conflicts, and related context may be accessed and surfaced. Because this skill combines multiple potentially sensitive data sources, missing privacy disclosure increases the risk of users enabling or using it without understanding what information will be collected, processed, or displayed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes a morning briefing composed of overdue tasks, priorities, calendar, and meeting context. The customization section adds 'Always show weather' as a supported briefing element, but no earlier description or data source defines weather as part of the skill's purpose or implementation scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

"Weekly preview" is less ambiguous than the other phrases but is still generic enough to collide with ordinary planning conversation. The risk is lower because it is a more task-oriented phrase, yet accidental activation could still expose upcoming schedule and deadline information.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.