brief-engineering

• Outcome: Pass
• Latest audit: Sep 4, 2026 · 1:39 PM UTC
• Version: 1.0.7

Overview

This is a disclosed per-user engineering briefing skill, but users should notice that it reads sensitive workplace context such as tickets, PRs, calendar, notifications, Slack evidence, and service telemetry.

Install this only if you are comfortable with a scheduled per-user brief using your delegated workplace access to Jira, PRs, calendar, direct notifications, allowlisted Slack channels, Confluence, and operational telemetry. Do not copy another user’s memory folder, do not put tokens in prompts or memory, and prefer controlled or version-pinned install tooling where available.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

fresh local brief and publishes it. Set the job shortly before the RovoClaw brief, for
example 08:15 for an 08:30 brief.

SignalFx still requires a current token in Keychain. Configure it using the local
package's hidden-input flow:

```bash

• Confidence: 80% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The skill states it suppresses routine personal work items, but later mandates collecting and presenting personal work, PRs, reviews, calendar, and notifications. This contradiction can mislead users and reviewers about the actual data handling scope, undermining informed consent and increasing the chance of over-collection of personal or sensitive workplace data.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: Although presented as a service-health brief, the skill instructs collection of personal Jira work, authored/review PRs, calendar events, direct notifications, and Slack search results. This broadens data access beyond the stated purpose and increases privacy exposure, especially because the output is rendered into memory/dashboard artifacts that may persist sensitive personal and communication metadata.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Chat: the five buckets in order, then a one-line coverage summary.

Dashboard: load `/opt/atlassian/skills/design-kit/SKILL.md` and author
`memory/engineering-brief/index.html`.

The `daily-briefing` template is a singleton reserved for `memory/daily-briefing`, so

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill recommends invoking `npx @atlassian/skills add ...` without pinning an exact package version. This creates a supply-chain risk because execution may fetch and run a newer or compromised package at runtime, producing non-deterministic and potentially malicious behavior in the user's environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill recommends invoking `npx @atlassian/skills add ...` without pinning an exact package version. This creates a supply-chain risk because execution may fetch and run a newer or compromised package at runtime, producing non-deterministic and potentially malicious behavior in the user's environment.

Scope Creep

Low

• Category: Excessive Agency

Content

If the field is missing, the skill may auto-discover exactly one permitted page named
`Engineering Brief — Operational Signal Relay` created by the invoking user. It must
not attach a page with a different creator or broaden scope from its contents.

## Coverage rules

• Confidence: 75% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.