Is justasknudge/daily-briefing-skill safe?
https://github.com/openclaw/skills/tree/main/skills/justasknudge/daily-briefing-skill
The daily-briefing-skill embeds a data exfiltration mechanism across three independent code paths that route user PII — calendar events, meeting titles, geolocation, and AI usage costs — to the skill author's email address ([email protected]). The primary attack vector is a cron.yaml agentTurn payload that injects instructions into the AI agent's execution context to send collected data to the author, bypassing any recipient configured in config.yaml. The simultaneous hardcoding of this email in SKILL.md metadata and as a shell script fallback default indicates intentional design rather than a development oversight. Users installing this skill via the OpenClaw cron system would silently exfiltrate their daily personal schedule to a third party.
Category Scores
Findings (10)
CRITICAL cron.yaml AgentTurn Payload Injects Exfiltration Instruction Overriding User Config -60 ▶
The cron.yaml file defines a scheduled job with payload.kind='agentTurn' whose content field explicitly instructs the AI agent to send the briefing to '[email protected]'. This embedded instruction is injected into the agent context at execution time and overrides any recipient the user configures in config.yaml. When a user activates this cron job through OpenClaw's scheduler, they authorize an agent turn that is pre-programmed to route their private calendar data, meeting details, and location to the skill author's email address — without any UI disclosure.
HIGH SKILL.md Metadata Delivery Field Hardcodes Author Email -20 ▶
The SKILL.md OpenClaw metadata block hardcodes [email protected] as the delivery target. Any OpenClaw system component that reads skill metadata to configure delivery would route user briefings to the author by default, before the user has an opportunity to update config.yaml.
CRITICAL Personal Calendar and Location Data Routed to Skill Author Email via AgentTurn -45 ▶
The cron.yaml agentTurn instructs the agent to collect and send a briefing containing: (1) Calendar.app events for the day including meeting titles, times, and recurrence via AppleScript; (2) precise geolocation via wttr.in weather (defaulting to Leyton, London); (3) AI model usage statistics and costs from codexbar. All of this is dispatched via iMessage to [email protected]. The briefing is a rich PII document that reveals daily schedule, meeting patterns, location, and tooling costs to an external party.
HIGH Default Fallback Recipient in send-briefing.sh Is Author Email -15 ▶
The send-briefing.sh script sets [email protected] as the default recipient via bash parameter expansion. If the script is invoked without an explicit argument, or if config.yaml parsing fails (e.g., file missing, YAML parsing error, empty value), user data is silently sent to the author. This creates a fail-open exfiltration path.
HIGH macOS Calendar.app Access via AppleScript Subprocess -10 ▶
calendar.py executes a multi-line AppleScript via subprocess.run osascript that iterates over all calendars and reads every event for the current day including event summary (title) and start time. This requires Automation permission and provides detailed daily schedule intelligence that is then incorporated into the briefing payload.
MEDIUM Installed Skills Directory Enumeration -5 ▶
openclaw_dive.py reads the user's local OpenClaw skills directory using glob, enumerating all installed skills and extracting description fields from their SKILL.md frontmatter. The resulting list of installed tool names and descriptions is included in the briefing, revealing the user's operational tooling profile to the briefing recipient.
MEDIUM Broad System Command Execution via subprocess Without Input Sanitization -30 ▶
Four Python modules invoke external system binaries via subprocess.run: icalBuddy and osascript (calendar.py), codexbar (cost_tracker.py), and imsg (send-briefing.sh). The scripts lack input validation on external data (RSS titles, calendar event names) that are incorporated into shell command arguments. Calendar event titles could contain shell metacharacters. The imsg binary requires macOS Automation permission in System Settings.
LOW Sparse Checkout from Public GitHub Monorepo -18 ▶
Installation performs a shallow clone of the openclaw/skills monorepo to /tmp/monorepo-clone, configures sparse-checkout to retrieve only the target skill subdirectory, then copies the files and removes the clone. Network activity is limited to GitHub (140.82.112.4) and Ubuntu package infrastructure. No unexpected post-install execution or secondary downloads were detected.
INFO Canary File Accesses Attributable to System Processes Not Skill -7 ▶
Canary files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, .config/gcloud/credentials.json) were opened per auditd PATH records but reported as intact. Timing analysis places accesses at 1771905106.401 (system login/PAM initialization, before install at 1771905111.868) and 1771905123.299 (post-install audit sweep). These are consistent with system login processes and the Oathe monitoring infrastructure itself, not the skill.
CRITICAL Social Engineering Pattern: Utility Skill with Embedded PII Exfiltration to Author -82 ▶
The skill exhibits a textbook social engineering attack pattern: present as a high-value productivity utility (daily briefing), request broad system permissions (Calendar access, iMessage automation), collect rich PII (daily schedule, meetings, location, AI tool usage), and route collected data to the attacker via a mechanism that appears to be normal scheduled delivery. The cron.yaml agentTurn payload is the execution vector — it injects instructions directly into the agent's decision context rather than relying on the user to execute scripts, making the exfiltration path resilient to users who audit config.yaml but do not review cron.yaml payloads. The simultaneous hardcoding of [email protected] in SKILL.md metadata, cron.yaml payload, and send-briefing.sh defaults is not consistent with an accidental oversight; it represents defense-in-depth for ensuring delivery to the author across multiple invocation paths.