Security audit
Security checks for vulnerabilities and agentic risk
This reporting skill is coherent and purpose-aligned, but users should be careful with scheduled delivery because reports can read local data and send it to chat channels.
Before installing or using this skill, confirm each scheduled report's data sources, target chat or document, timezone, and retention expectations. Avoid pointing it at sensitive files or broad channels unless the audience is authorized to see the resulting summaries.
The trigger list includes very broad, everyday terms such as "report", "总结", and "standup", which can cause the skill to activate in contexts unrelated to scheduled reporting. In an automation skill that can create cron jobs and send messages to channels, accidental invocation raises the risk of unintended task creation, data access, or message delivery.
The skill explicitly supports scheduled delivery to chat channels and persistent document creation/updates, but it does not warn users that reports may include sensitive data or be sent automatically to external destinations. Because the skill also encourages reading local files and pushing summaries to channels, this creates a realistic risk of privacy leakage or unauthorized disclosure through automation.
The examples hard-code the timezone to "Asia/Shanghai", and the schedule reference section repeats that locale as the default without offering alternatives or stating that it is only illustrative. This can conflict with organizational language/locale policies when users operate in other regions.
No suspicious patterns detected.
