Morning Brief

Delivers a daily 7 AM CDT briefing with local weather, one key healthcare revenue insight, Pittsburgh sports updates, and seasonal fantasy baseball news.

Security Scan

The SKILL.md describes a public-facing morning brief (weather, sports, RCM news) but the included code silently reads the user's Gmail inbox using credentials that are not declared — this mismatch could be accidental or a risky data-exfil path (cron posts to Discord).

Purpose & Capability

The skill advertises weather, RCM news, sports, and fantasy updates. The bundled email_briefing.py reads a Gmail inbox via IMAP and summarizes messages — functionality not mentioned in SKILL.md and not justified by the described brief.

Instruction Scope

SKILL.md runtime instructions never mention reading email. The code accesses mailbox contents and prints summaries; if the agent includes those summaries in the scheduled 'announce' delivery to a Discord channel, that could leak private email content. The code also expects env vars not declared in the manifest.

Install Mechanism

No install spec (instruction-only). No external downloads or archive extraction. Risk comes from included code file, not from an installer.

Credentials

email_briefing.py reads GMAIL_EMAIL and GMAIL_APP_PASSWORD from environment but requires.env lists none. Requesting a Gmail app password is high-privilege and disproportionate to the stated skill purpose; storing such credentials (comment references ~/.openclaw/.env) increases exposure.

Persistence & Privilege

always is false and the skill is not force-installed. However, the cron config will schedule an automated daily job that announces output to Discord — combining automated runs with undeclared Gmail access raises the blast radius if the code is executed.

What to consider before installing

Do not install this skill until the author clarifies or fixes it. Specific actions to consider: 1) Ask the publisher why email access is included and require that they either remove email_briefing.py or explicitly document and justify GMAIL_EMAIL and GMAIL_APP_PASSWORD in the manifest. 2) If email access is needed, require least-privilege controls (use a dedicated, limited Gmail account and an app password that can be revoked). 3) Confirm where outputs will be posted — the cron shows a Discord announce; ensure private inbox summaries are not posted to public channels. 4) Request a code review or remove the file; ensure required env vars are declared so you can make an informed decision. 5) If you must test, run in an isolated environment and do not use real credentials or production inboxes.

Skill: Morning Brief

Purpose: JB's daily wake-up brief. Consolidates everything into one message.

Trigger: Daily 7 AM CDT (cron)

Replaces: Old "Morning Pulse" + "RCM Pulse Daily"

---

What It Includes

1. Weather (Mission, KS)

• Garmin weather via wttr.in
• Running conditions (temp, humidity, wind, feels-like)

2. RCM Pulse (1 insight)

• Top healthcare revenue cycle news
• 1 actionable insight max

3. Pittsburgh Sports

• Penguins/Steelers/Pirates scores or next game
• API: BallDontLie for NFL/MLB, web search for NHL

4. Fantasy Baseball (season only)

• If MLB season active: brief FA update
• If offseason: skip

---

Output Format

☀️ MORNING BRIEF — March 21, 2026

🏃 RUNNING
High 68° • Low 45° • Wind 12 mph • Run conditions: Good

📰 RCM PULSE
Payer behaviors now #1 risk to revenue (denials up 11.8%). 

🏒 PENGUINS: Next Sat vs WPG 1:00 PM
🏈 STEELERS: Draft Apr 24
⚾ PIRATES: Season starts March 26

📡 Fantasy: Week 1 FA — monitor Cody Ponce, Luke Weaver

---

Cron

{
  "name": "morning-brief",
  "schedule": { "kind": "cron", "expr": "0 7 * * *", "tz": "America/Chicago" },
  "payload": { "kind": "agentTurn", "message": "Run Morning Brief skill. Get weather, RCM news, Pittsburgh sports, fantasy update. Post to JB." },
  "sessionTarget": "isolated",
  "delivery": { "mode": "announce", "channel": "discord" }
}

---

Quality Rules

• Keep under 300 words
• Lead with weather (most actionable)
• Only 1 RCM insight (not 3)
• Sports: lead with what's playing soon
• Skip fantasy if offseason

---

Files

• /workspace/skills/morning-brief/SKILL.md (this)