Security audit
Security checks for vulnerabilities and agentic risk
This daily briefing skill is coherent and disclosed, but users should know it may summarize recent private messages and calendar events when invoked.
Install only if you are comfortable with a daily briefing tool reading near-term calendar events and unread or important recent messages when you ask for a digest. Prefer explicit invocations and disable or avoid news/weather lookups if you do not want location or topical queries sent to external services.
The top-level description uses broad trigger language like 'daily digest', 'morning briefing', and 'quick overview of what matters today', which can overlap with ordinary conversation and cause unintended activation. In this skill, accidental invocation is more concerning because the workflow may access calendar, unread messages, and web search without an explicit, task-scoped confirmation.
The 'When to Use' section includes ambiguous conditions such as 'what's going on today' and generic morning check-ins, which increases the chance the skill runs in contexts where the user did not intend a privacy-sensitive aggregation. Because the skill combines multiple personal and external data sources, loose invocation guidance materially raises the risk of over-collection and surprise data access.
The skill instructs the agent to summarize unread or important messages and upcoming calendar events but does not clearly warn that private communications and schedule data will be accessed. This is dangerous because users may trigger the skill for a simple summary without realizing it will inspect sensitive personal content, creating privacy and consent issues.
The inputs specify locale with a default of en, which imposes a specific language by default. The file does not indicate that the user is asked to choose a language or that the English default is justified by a documented regional constraint.
The skill may use wttr.in and web_search to retrieve weather and news, but it does not disclose that user context such as location, timezone, or inferred interests may be sent to external services. This creates a data-sharing risk, particularly when the briefing is generated automatically or as part of a recurring digest.
This manifest file describes the skill's purpose in general terms but does not specify how or when it should be invoked, nor does it provide any constraints or exclusion conditions. Because manifest files are in scope for vague-trigger review, the lack of trigger specificity could allow overly broad matching against common requests for a daily summary.
No suspicious patterns detected.
