Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Weekly Report Generator
v1.0.0AI-powered weekly report generator. Scans GitHub issues/PRs, calendar events, reminders, and project files to generate a polished weekly report in Markdown....
⭐ 0· 44·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's stated purpose (aggregate GitHub, calendar, reminders) matches the included code which clearly implements GitHub collection and local report generation. However SKILL.md and README reference additional source modules (scripts/sources/*) and calendar/reminder integrations that are not present in the file manifest; this suggests either incomplete packaging or overstated capabilities.
Instruction Scope
The runtime instructions focus on fetching GitHub data and generating a local report, which is within scope. They instruct users to set GITHUB_TOKEN and optional FEISHU/Reminders integrations. The code uses GITHUB_TOKEN and dotenv; reminders/calendar integrations are described as relying on other skills but the code's reminders collector is a placeholder that returns no data. Instructions are not asking the agent to read unrelated system files, nor to exfiltrate to unknown endpoints.
Install Mechanism
There is no install spec that downloads remote archives or executes installers; the package simply includes a Node script and package.json listing small, common dependencies (date-fns, dotenv). This is low risk from an installation-source perspective.
Credentials
Registry metadata lists no required environment variables, yet SKILL.md and the script document and use GITHUB_TOKEN (and README mentions FEISHU_APP_ID/FEISHU_APP_SECRET). The skill loads .env via dotenv, which means any local .env secrets could be read at runtime. The absence of declared required env vars in the registry is an inconsistency that reduces transparency and could surprise users who assume no credentials are needed.
Persistence & Privilege
The skill is not force-enabled (always:false) and does not request system-wide configuration changes or elevated privileges. It runs as a one-off script and does not persist or modify other skills' settings.
What to consider before installing
This skill appears to implement GitHub-based weekly reports and does not contain obviously malicious code, but there are mismatches you should be comfortable with before installing:
- The registry metadata declares no required env vars, but the code uses GITHUB_TOKEN and README/SKILL.md mention FEISHU and reminders credentials. Treat this as an omission and assume you must provide a token for private repo access.
- The SKILL.md/README reference additional source files (calendar/reminders collectors) that are not included. The missing files may mean some integrations won't work or the package is incomplete.
- The script uses dotenv and will load a local .env if present — ensure your .env does not contain unrelated secrets you don't want the skill to read.
Steps to reduce risk:
- Inspect the included scripts/generate-report.mjs yourself (or have a developer do so) to confirm where network calls are sent (GitHub API is expected). Look for any hard-coded remote endpoints beyond api.github.com.
- If you must provide a GITHUB_TOKEN, create a token with the minimum scopes required (public_repo or repo scope as needed), or use a read-only token / throwaway account if you want to test.
- Run the skill in dry-run mode first and with GITHUB_TOKEN unset to verify behaviour without exposing credentials.
- Ask the publisher for the missing source files or a project homepage and verify the author (fx-world888) before providing any private credentials.
Given the inconsistencies (undeclared env vars, missing modules), I mark this as suspicious rather than benign; these could be harmless packaging oversights but deserve verification.scripts/generate-report.mjs:73
Environment variable access combined with network send.
scripts/generate-report.mjs:8
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97awx6r1ghhm9acfzhbvpyztx84drdw
License
MIT-0
Free to use, modify, and redistribute. No attribution required.