Daily Report Skill

• Outcome: Review
• Latest audit: May 29, 2026 at 9:22 PM UTC
• Version:
  1.0.0

Overview

This daily reporting skill is coherent, but it can automatically read private workspace notes or conversation context and send summaries to external chat services without clear review controls.

Review before installing if your workspace memory or conversations may contain sensitive information. If used, configure only trusted channel targets, keep conversation logs and task status opt-in, and require a preview/redaction step before scheduled or multi-channel sends.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly collects journal content, conversation logs, and task status, then sends the generated report through external message APIs, but it provides no warning, consent step, data minimization guidance, or channel trust boundaries. This creates a real data-exfiltration/privacy risk because potentially sensitive internal context can be transmitted off-platform automatically or with only a simple trigger.

VirusTotal

66/66 vendors flagged this skill as clean.