Daily Brief Digest

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:35 PM UTC
• Version: 1.0.0

Overview

The skill is a real daily-digest helper, but it handles private email and calendar data, stores full reports permanently, and encourages recurring automated runs without enough containment or retention controls.

Install only if you are comfortable with the skill reading local email and calendar data, creating permanent local digest archives, and optionally sending summaries through your configured messaging channel. Review or disable the cron setup unless you want unattended daily runs, and consider modifying the script to escape HTML, restrict file permissions, redact sensitive fields, and add retention or opt-out controls.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/digest.js:13

Finding

Persistent Plaintext Storage of Sensitive Personal Data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/digest.js:42

Finding

Stored HTML Injection Through Unescaped Digest Data

Content

View full analysis

0 ? emails.map(e => `

${e.subject}

From: ${e.from.name || e.from.addr} • ${new Date(e.date).toLocaleTimeString([], {hour: '2-digit', minute:'2-digit'})}

`).join('') : '

No urgent emails found.

'} ``` ```javascript ${calendar.length > 0 ? calendar.map(c => `

${c.summary}

${c.start} - ${c.end}

`).join('') : '

Your schedule is clear today.

'} ``` ```javascript ${tasks.length > 0 ? tasks.map(t => `

${t.title}

${t.due ? `

Due: ${t.due}

` : ''}

`).join('') : '

No tasks due today.

'} ``` ```javascript ${news.length > 0 ? news.map(n => `

${n.title}

Remediation

View remediation

', '>') .replaceAll('"', '"') .replaceAll("'", '''); } ``` 2. Use `escapeHtml` for subjects, names, addresses, event data, task data, titles, and snippets. 3. Validate URLs separately rather than relying only on HTML encoding: ```javascript function safeHttpUrl(value) { try { const url = new URL(String(value)); return ['https:', 'http:'].includes(url.protocol) ? url.href : '#'; } catch { return '#'; } } ``` 4. Encode the validated URL before placing it into the `href` attribute. 5. Reject dangerous or unnecessary schemes, including `javascript:`, `data:`, `file:`, and custom application protocols. 6. Validate the complete input structure and require expected primitive types before rendering. 7. Prefer a maintained templating system with automatic contextual escaping. 8. If raw HTML is not required, generate ordinary Markdown text and escape Markdown control characters. 9. If HTML output remains necessary, sanitize the completed document with a well-reviewed allowlist sanitizer. 10. Ensure the viewing environment disables scripts, event-handler attributes, embedded frames, forms, and unauthorized external resources. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared purpose says the skill generates a daily brief, but the workflow also persists the report to disk, may inspect tasks/contacts, and sends a notification, all of which materially expand its behavior beyond a simple summary. This mismatch undermines informed consent and can expose sensitive personal data by causing users or orchestrators to invoke the skill without realizing it performs retention and broader data collection.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill invokes local capabilities and sensitive data sources (himalaya, gog, and implied environment/local tooling) without declaring an explicit tool or permission scope. That makes the skill's effective privileges opaque to users and reviewers, increasing the chance of overbroad access to email/calendar data or unsafe execution in a more privileged runtime than expected.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The workflow goes beyond generating a brief by automatically saving a permanent historical log and sending a message notification. Those side effects create privacy and retention risks because personal email and calendar content may be stored and broadcast even when the user only asked for a transient morning summary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation phrases are broad enough that ordinary requests for a 'status update' or similar wording could trigger the skill in contexts where the user did not intend email/calendar/news aggregation. Because this skill accesses sensitive personal data and performs side effects, unintended activation increases the chance of unnecessary data access and logging.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs the agent to create permanent local records containing content derived from personal emails and calendar events, then direct the user to those logs. Persistent storage of sensitive communications and schedule data creates a substantial privacy risk, expands the blast radius of compromise, and may violate data-minimization expectations for a simple daily digest.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The document instructs users to create a persistent cron job that will automatically run the skill every morning, causing repeated access to email, calendar, and news sources without a fresh user action each time. Persistent automation is risky here because the task handles private communications and can also log and forward results, so any over-collection, prompt injection, or misconfiguration becomes a recurring issue.

Content

Scanner excerpt · references/cron-guide.md (reported line 3)May include surrounding context.

md

# Setting Up the Daily Digest Cron Job

To have your digest generated automatically every morning, add a cron job to OpenClaw.

## Example Cron Command

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide explicitly states that the automated digest will access private emails and then send a summary through external messaging channels, but it does not warn the user about the privacy implications or encourage limiting sensitive content. In a recurring cron context, this increases the chance that confidential information is routinely exfiltrated to third-party channels or exposed on less secure devices.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

A daily briefing skill is expected to summarize provided email/calendar/news data, but this implementation shells out to an external program via execSync to fetch mail directly. That subprocess execution capability is more powerful than the manifest’s stated purpose and is not mentioned as part of the skill’s scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script collects personal email data and combines it with calendar items, tasks, and news, then stores the resulting digest on disk without any visible consent, notice, or data-minimization controls. Even if intended for convenience, silent collection and retention of sensitive personal data creates a meaningful privacy and security risk in a personal-assistant context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script writes the full daily digest, including email subjects/senders, calendar events, and tasks, to a persistent file under the user's home directory. This creates unnecessary local retention of sensitive personal data beyond the stated briefing function, increasing exposure to other local users, backups, endpoint compromise, or later unintended reuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest scope names urgent emails, upcoming calendar events, and relevant news as the components of the daily brief. The code also accepts and renders a separate tasks section, extending behavior beyond the described data sources.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The call to toLocaleDateString explicitly hard-codes 'en-US', which imposes a specific language/locale format regardless of the user's preferences. This matches the policy-violation category for locale constraints because there is no opt-in, configurability, or documented region-specific justification in the file.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/digest.js:20