Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
用来帮你写周报把图文周报变成漂亮图片的skill--当前版本是苹果的风格
v1.0.0周报助手 — 将用户的工作内容、周报、日报、总结一键生成一张 4:3 极简科技风汇报卡片(单张图,非多页PPT)。触发词:周报助手、周报卡片、日报卡片、一张图、汇报卡、生成卡片。
⭐ 0· 39·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (generate a one-page 4:3 report card image) aligns with the runtime instructions (extract text, build HTML, screenshot to PNG). However, the SKILL.md assumes the presence of a headless Chrome/Chromium binary (and optionally puppeteer) and a writable ~/.openclaw/workspace path even though no required binaries or install steps are declared—this is an undeclared dependency.
Instruction Scope
Instructions tell the agent to 'read original content' and must include any user-sent images 100%, but do not define the exact source (conversation messages, uploaded files, or filesystem). The skill writes output to ~/.openclaw/workspace/card-YYYYMMDD.html and attempts to launch a local Chrome binary at a macOS-specific path to take a screenshot. It also pulls Tailwind and Google Fonts from CDNs. These behaviors involve filesystem writes and network access and should be explicit in the metadata; the lack of declared dependencies or explicit user consent is a concern.
Install Mechanism
This is instruction-only (no install spec), which is lower risk. But the instructions rely on external tooling (headless Chrome/Chromium or puppeteer) and remote CDNs for CSS/fonts; since no install or dependency list is provided, the skill will fail or behave unexpectedly on systems without those tools. The macOS-specific Chrome path may not exist on non-macOS systems.
Credentials
The skill does not request any environment variables, credentials, or config paths beyond writing to a subpath in the user's home. There is no disproportionate credential access requested.
Persistence & Privilege
always:false and the skill is not attempting to modify other skills or system-wide settings. It does, however, write output HTML to ~/.openclaw/workspace, which is persistent storage in the user's home; this is reasonable for a generator but should be documented and the path should be configurable or disclosed to users.
What to consider before installing
This skill appears to do what it says (generate a single 4:3 card image), but there are some missing details you should confirm before using it:
- Confirm the platform/tooling: the SKILL.md expects a headless Chrome/Chromium (example macOS path shown) or puppeteer to take screenshots. The skill metadata does not declare this dependency. If you don't have Chrome/Chromium or puppeteer, the automatic screenshot step will fail; ask the author to declare required binaries or provide an alternative.
- File writes: the skill saves HTML under ~/.openclaw/workspace/. If you care where files land, make sure you can change that path or inspect the saved HTML before screenshots are taken.
- Network access: the generated HTML loads Tailwind and Google Fonts from CDNs (the SKILL.md even suggests mirrors). That means the skill will cause your environment to make outbound requests for styling assets; if you need offline or private rendering, request local assets or an option to inline styles.
- Image inclusion: the instructions require including any user-sent images unmodified. Be cautious about including sensitive images; the skill will embed them into the card and potentially upload them if you later share the output.
If you plan to enable this skill: ask the author to add an explicit dependency list (Chrome/Chromium or puppeteer), make the output path configurable, and document exactly where input content/images are read from. If you cannot get those assurances, consider running the skill in a sandboxed environment or only using it with non-sensitive inputs.Like a lobster shell, security has layers — review code before you run it.
latestvk97brjtbx93z6fx3kfyny4j5xn84m59n
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
