daily-debrief
Warn
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs several shell-based operations to manage files and execute external logic.\n
- Evidence: Invokes a local Python script
scripts/harvest.pyfrom the associatedmission-logskill to gather session data.\n - Evidence: Utilizes system commands like
mv,wc, andgrepto archive old logs and verify the integrity of new reports.\n - Evidence: Provides explicit instructions for users to set up automated execution through
launchdorcron, creating persistent background tasks.\n- [COMMAND_EXECUTION]: The skill facilitates the execution of arbitrary commands based on local configuration.\n - Evidence: It is designed to read
~/.claude/journal/config.envand execute any command defined in theJOURNAL_POST_CMDvariable, passing the report path as an argument.\n- [DATA_EXFILTRATION]: The skill encourages the transfer of local activity logs to external platforms.\n - Evidence: Recommends synchronizing raw journal data across different machines using
sshorgitrepositories.\n - Evidence: Supports sending processed summaries to external notification services such as Notion, Telegram, or Slack.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its data ingestion patterns.\n
- Ingestion points: Reads conversation data via
harvest.py, as well as event data from calendar and task management CLI tools.\n - Boundary markers: Absent. The skill instructions do not specify any delimiters or warnings to prevent the agent from following instructions embedded in the gathered data.\n
- Capability inventory: The skill has access to shell execution, file system modification, and arbitrary command execution via user-defined configuration.\n
- Sanitization: Absent. There is no evidence of input validation or escaping for the external data included in the final Markdown reports.
Audit Metadata