Is daijo-bu/daily-questions safe?

https://github.com/openclaw/skills/tree/main/skills/daijo-bu/daily-questions

89
SAFE

This skill appears to be a legitimate daily questionnaire system that asks users personal questions via Telegram and updates profile files accordingly. While it does modify agent behavior files and could theoretically be used for social engineering, these capabilities align with its stated purpose and present minimal security risk.

Category Scores

Prompt Injection 85/100 · 30%
Data Exfiltration 95/100 · 25%
Code Execution 98/100 · 20%
Clone Behavior 95/100 · 10%
Canary Integrity 100/100 · 10%
Behavioral Reasoning 85/100 · 5%

Findings (3)

LOW Output suppression instruction -5 ▶

The skill instructs the agent to 'respond with NO_REPLY' after sending Telegram buttons, which is a form of output control. However, this appears to be for legitimate UX purposes to avoid duplicate messages.

LOW Behavior modification through file updates -10 ▶

The skill reads and updates USER.md and SOUL.md files which could potentially influence future agent behavior. This is the stated purpose of the skill but presents a minor risk if malicious content is introduced.

INFO Social engineering potential -15 ▶

The skill's purpose of asking personal questions could theoretically be used for social engineering, but this is inherent to its legitimate function as a user profiling tool.