x-daily-briefing
Warn
Audited by Gen Agent Trust Hub on Feb 21, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION] (MEDIUM): The skill instructions require the agent to execute a local Python script using
poetry run python scripts/daily_briefing.py. This introduces a dependency on the integrity of thescripts/directory content within the skill's environment. - [DATA_EXPOSURE] (MEDIUM): The skill explicitly directs the agent to access
~/.config/timtracker/config.jsonto retrieve an API key. Accessing the~/.config/directory is a sensitive operation as it often contains credentials for various system services. - [EXTERNAL_DOWNLOADS] (LOW): The script communicates with
https://timtracker-api.vercel.app. While this is the intended data source, the domain is not a verified trusted source, and the integrity of the data returned (which is later processed by the agent) depends on the security of this endpoint. - [INDIRECT_PROMPT_INJECTION] (LOW): The skill possesses a data ingestion surface (Category 8). It fetches external data from a web API and directs the agent to process and format this data into a local file (
_DAILY.md). There are no explicit boundary markers or sanitization steps mentioned to prevent malicious instructions embedded in the health data from influencing the agent's behavior during the markdown generation phase.
Audit Metadata