Security audit

daily-briefing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed daily-briefing helper that reads weather, calendar, messages, and news only to produce the requested summary.

Install this only if you want a briefing tool that may read upcoming calendar events and recent unread or important messages when invoked. Use explicit requests, and avoid enabling recurring runs unless you are comfortable with that scheduled access.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger guidance is broad enough that the skill could be invoked for vague requests like 'what's going on today' or general check-ins, causing it to access weather, calendar, messages, and news when the user may not have intended a data-aggregating workflow. In a skill that touches personal communications and calendar data, overbroad activation increases the chance of privacy-invasive execution from ambiguous prompts.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill description and behavior do not clearly warn that it may read personal messages, inspect calendar events, and call external services for weather/news. That missing transparency can lead to informed-consent and privacy issues, especially because the skill aggregates multiple sensitive sources in one run.

Static analysis

No suspicious patterns detected.