Security audit
Security checks for vulnerabilities and agentic risk
This is a simple daily reporting skill with disclosed local logs and Telegram alerts, with privacy and timezone settings users should review.
Before installing, confirm you want reports on the listed Spain-time schedule, configure Telegram only if that channel is approved for your business data, and periodically review or delete the local memory logs if they contain operational details.
The skill mandates immediate Telegram alerts for operational events without any privacy warning or constraints on what information may be transmitted externally. This can leak business activity, budget status, replies, or system errors to a third-party messaging platform, potentially exposing sensitive operational metadata.
The instruction to send the morning report at 9:30 AM Spain imposes a specific locale/timezone in natural language. The file does not offer user opt-in or explain why Spain is required, which conflicts with the policy against forcing a specific language or locale without choice.
The line Send at 9 PM Spain specifies a fixed locale/timezone for report delivery. Because the skill does not present this as configurable or justify it as region-specific, it constitutes a natural-language locale policy issue.
The skill instructs saving daily logs to persistent memory files, which modifies user data/state without any explicit warning, confirmation, or retention guidance. While the stored content appears operational rather than highly sensitive, silent persistence can create privacy, audit, and accidental data retention risks.
The memory file format section directs the agent to save structured operational data to local markdown files without warning that this creates persistent storage. Even if the data is business-oriented, local files may expose workflow details, metrics, and notes to unintended readers or future processes.
No suspicious patterns detected.
