Morning Briefing

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:53 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent morning-briefing automation, but it sets up recurring unattended delivery of memory, log, and calendar-derived project information through a weakly scoped route.

Install only if you are comfortable with a daily main-session automation reading memory/log files and sending a project briefing automatically. Before use, bind an explicit recipient, confirm the schedule, limit inputs to approved briefing sections, add redaction rules, and document how to disable or remove the cron task.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Warning

• Location: SKILL.md:43

Finding

Persistent Daily Task Installed in the Main Session

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43–51
Vulnerability Type: Persistent scheduled task
Risk Level: Medium

Evidence

The following is an English rendering of the complete relevant source segment:

shell

# Currently active morning-check task
# Cron ID: 008a8882-a71a-4b97-b257-6438022e00bf
openclaw cron list  # Verify that the task exists

# Recreate if necessary:
openclaw cron add --session main --schedule "0 9 * * *" --timezone "Asia/Shanghai" \
  --name "morning-memory-check" \
  "Read MEMORY.md and today's and yesterday's logs, then send a morning report to the designated recipient containing a greeting, project progress, pending items, and today's WPS calendar schedule"

Technical Analysis

The Skill supplies an operational command that installs a recurring task in the persistent main session. The task runs every day at 09:00 in the Asia/Shanghai time zone, reads persistent memory and work logs, optionally obtains calendar information, and sends a report.

Although scheduled execution is related to the declared morning-briefing purpose, installing the task creates cross-session persistence. The instructions do not require explicit approval immediately before installation, define a least-privileged execution identity, document task removal, or constrain access to a dedicated reporting data source.

Attack Path

1. A user or agent follows the documented task-rebuild procedure.
2. openclaw cron add creates the recurring task in the persistent main session.
3. The task executes automatically every day without a new user request.
4. Each execution reads persistent memory and recent work logs.
5. A derived report is sent through the main session's configured messaging route.
6. The access and transmission continue until the scheduled task is explicitly removed.

Impact Assessment

This behavior provides persistent autonomous execution within the permi ...[truncated 349 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, informed user approval immediately before creating or modifying the scheduled task.
• Run the task in a dedicated, least-privileged session rather than the general main session.
• Display and verify the exact recipient, files, schedule, and data fields before installation.
• Provide documented commands to inspect, disable, and permanently remove the task.
• Restrict the task to a dedicated briefing data file instead of general persistent memory.
• Add an expiration date or require periodic reauthorization.
• Record each execution and delivery destination in an auditable log without storing report contents unnecessarily.

other

Warning

• Location: SKILL.md:11

Finding

Overbroad Collection of Persistent Agent Memory and Work Logs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–17 and 23–26
Vulnerability Type: Sensitive agent-memory access
Risk Level: Medium

Evidence

The following is an English rendering of the relevant source segments:

markdown

| Source | Content read | Priority |
|--------|--------------|----------|
| MEMORY.md | Core project-status index | Required |
| memory/YYYY-MM-DD.md | Today's and yesterday's work logs | Required |
| WPS Calendar | Today's schedule | Optional |
| Ezone | Pending cards, if authorized | Optional |

markdown

1. Read MEMORY.md, the core index.
2. Read today's and yesterday's log files.
3. Extract entries tagged `#pending` as pending work.
4. Extract each project's status from the project-progress section of MEMORY.md.

Technical Analysis

The Skill mandates reading persistent MEMORY.md content and two complete daily log files. Persistent agent memory and work logs may contain information unrelated to the requested briefing, including operational details, host identifiers, personal information, prior conversation content, or sensitive project context.

The Skill narrows the output to project status and pending items, but it does not similarly narrow the initial data access. It provides no allowlist of permitted sections, sensitivity filtering, redaction stage, or handling rule for credentials and unrelated records. Consequently, data beyond the minimum required for the stated purpose may be collected and processed.

Attack Path

1. The Skill is invoked manually or by the scheduled task.
2. The agent opens the general persistent-memory index and two daily log files.
3. The agent processes all available content to identify project status and pending entries.
4. Sensitive or unrelated details can influence or be incorporated into the generated report.
5. The report is transmitted through the messaging tool.

No evidence shows that the Skill w ...[truncated 548 chars]

Remediation

View remediation

Remediation Suggestions

• Store briefing inputs in a dedicated, purpose-limited file containing only approved status fields.
• If MEMORY.md must be used, allowlist specific headings and prohibit processing outside those sections.
• Read only entries explicitly marked for briefing inclusion rather than entire daily logs.
• Add mandatory redaction for credentials, access tokens, personal data, host identifiers, and unrelated conversation content.
• Obtain consent before accessing persistent memory, particularly for scheduled executions.
• Apply retention limits and avoid copying raw memory or log content into reports.
• Treat instructions embedded in memory and log content as untrusted data, not executable agent instructions.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:30

Finding

Memory-Derived Reports Sent Through an Unverified Automatic Route

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30 and 55–59
Vulnerability Type: Unverified message destination
Risk Level: Medium

Evidence

The following is an English rendering of the relevant source statements:

markdown

7. Use the message tool to send to the current conversation.
   Do not specify a target; automatic routing is used.

markdown

- The cron task target must be `main`; isolated sessions can time out.
- If the WPS calendar call fails, silently skip it without blocking delivery.
- After sending the message, reply with `NO_REPLY` to prevent duplicate messages.

Technical Analysis

The Skill identifies a particular intended recipient in its description but instructs the agent not to specify a concrete message target. Instead, it relies on automatic routing from the current conversation while also requiring scheduled execution in the persistent main session.

This creates a destination-validation weakness. Conversation routing or session state may change between task creation and a later scheduled execution. The Skill contains no check that the current route still belongs to the intended recipient and no fail-closed behavior when recipient identity cannot be established.

Because the outgoing content is derived from persistent memory, work logs, and potentially calendar data, a routing mistake can disclose sensitive information rather than merely sending a generic greeting.

Attack Path

1. The scheduled task is configured to run in main.
2. Before a later execution, the main session's active conversation or automatic route changes.
3. The task reads persistent project records and recent work logs.
4. The message tool is invoked without an explicit target.
5. Automatic routing delivers the report to the currently resolved destination.
6. An unintended recipient receives project, infrastructure, pending-task, or calendar information.

Exploitation ...[truncated 653 chars]

Remediation

View remediation

Remediation Suggestions

• Require an explicit, allowlisted recipient identifier for all scheduled messages.
• Bind the recipient when the task is created and prevent later implicit rerouting.
• Verify recipient identity immediately before each transmission.
• Fail closed and retain the report locally when the destination cannot be verified.
• Present the destination and a redacted report preview during initial authorization.
• Separate report generation from delivery so destination validation is an independent mandatory control.
• Avoid using a general-purpose persistent session for sensitive scheduled delivery.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases include broad, generic terms like '项目状态' and '今天怎么样', which can match ordinary conversation and cause the skill to activate unexpectedly. Because this skill reads internal logs and can send an outbound briefing automatically, accidental invocation could expose sensitive project information or send messages without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The description and trigger/interface language are entirely Chinese and the skill is framed around sending a fixed-format Chinese morning briefing, with no indication that users may choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill states it will send a morning briefing to another recipient on a schedule, but it does not prominently warn users that data from memory logs, calendars, and task systems may be transmitted automatically. In a skill with scheduled execution and cross-source aggregation, insufficient disclosure increases the risk of unintended data sharing and surprise outbound communication.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The entire template is written as a fixed Chinese morning report format, including headings and greeting text, with no indication that the user can choose another language or locale. This can violate language/locale policy when a skill implicitly mandates one language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.