自动周报助手

• Outcome: Review
• Latest audit: May 28, 2026 · 5:45 AM UTC
• Version: 1.0.0

Overview

The skill broadly does what it claims, but it needs review because it handles work-account credentials, can send or publish report content, and has weak guardrails around local file writes and deletion.

Review before installing or running. Use least-privilege tokens or app passwords, avoid putting secrets directly in shell commands, restrict calendar and Feishu access to work-only sources, preview reports before sending or publishing, and avoid unattended cron runs until confirmations and path validation are added.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill describes capabilities to write local files, access external network services, and invoke shell tooling such as pandoc, but it does not declare any explicit permissions or safety boundaries. This creates an authorization and transparency gap: users and the platform cannot clearly evaluate or constrain sensitive operations like exfiltrating report contents, storing local history, or executing external commands.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The manual trigger phrases like “生成周报” and “整理本周工作” are broad and likely to appear in normal conversation, which can cause the skill to activate unintentionally. Because activation may fetch data, save local history, contact external services, or send content, accidental triggering can lead to unintended data processing or disclosure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill supports SMTP email and Feishu document writing but does not clearly warn users that report content and credentials may be transmitted to third-party services. This is dangerous because weekly reports often contain confidential project details, and users may not realize sensitive content will leave the local environment or be handled by external providers.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill automatically saves report history under ~/.weekly-report/history/ and supports deletion, but it does not warn users about local persistence of potentially sensitive work summaries. Silent storage increases the risk of confidential information remaining on disk longer than intended or being accessed by other local users, backups, or malware.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: `export_html` writes attacker-controlled output to an arbitrary filesystem path supplied by the caller, with no path validation or directory restriction. In an agent skill context, this can overwrite user files, place HTML in sensitive locations, or assist follow-on attacks if the agent has broad filesystem permissions.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The delete_report function permanently removes files and metadata immediately, with no built-in confirmation, soft-delete, or recovery mechanism. In an agent setting, this raises the risk of accidental or prompt-induced destructive actions that can erase user history without meaningful user awareness, especially because the skill description does not clearly advertise deletion behavior.

Credential Access

High

• Category: Privilege Escalation

Content

|--------|------|------|
| github_token | GitHub访问Token | 否 |
| github_repos | 监控的仓库列表 | 否 |
| feishu_token | 飞书Access Token | 否 |
| feishu_docs | 监控的文档/知识库 | 否 |
| smtp_host | SMTP服务器 | 否 |
| smtp_port | SMTP端口 | 否 |

• Confidence: 90% confidence
• Finding: The skill requires sensitive credentials such as GitHub tokens, Feishu access tokens, and SMTP usernames/passwords, but the manifest provides no safeguards for secure collection, storage, scoping, or handling. In a skill that also performs network operations, local storage, and email/document publishing, credential mishandling could enable account compromise, repository access, document abuse, or unauthorized mail sending.

Static analysis

No suspicious patterns detected.