kk每日备份汇报

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:13 PM UTC
• Version: 1.0.0

Overview

This skill is a local backup-status reporter that reads expected backup and note directories and prints file metadata, with no evidence of hidden execution, exfiltration, or destructive behavior.

Before installing, confirm the default backup and Obsidian paths match what you intend to inspect, adjust the timezone if needed, and treat generated reports as private because filenames and timestamps can reveal personal or operational details. Only add the optional cron entry if you explicitly want scheduled reporting.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Session Persistence

Medium

• Category: Rogue Agent

Content

### 方法2: 手动安装
```bash
# 创建目录
mkdir -p ~/.openclaw/workspace/skills/kk-daily-backup-report

# 复制文件
cp kk_backup_report_simple.sh ~/.openclaw/workspace/skills/kk-daily-backup-report/

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The visible title, usage instructions, and invocation phrase are entirely Chinese, including the required phrase `kk每日备份汇报` for use in session. Under the policy, locale-specific behavior should either offer a language choice or clearly document and justify that the skill is intended only for a Chinese-language context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly reads backup and Obsidian/note directories, which can contain highly sensitive data, yet the documentation does not warn users about the privacy implications. In an agent setting, this increases the chance that users invoke the skill without informed consent, potentially exposing filenames, timestamps, sizes, and note-related metadata from sensitive locations.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: This markdown file includes commands that extract an archive, create directories, copy files, and change file permissions in the user's home directory. The document presents these steps as routine installation actions but does not explicitly warn that they will modify the local filesystem.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The configuration example sets TIMEZONE="Asia/Shanghai", which imposes a specific locale-related default in natural-language documentation. The file does not indicate that this is optional, prompt the user to choose their timezone, or justify why the skill must be tied to that locale.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The guide recommends appending detailed backup reports to a local file, and those reports visibly include backup filenames, timestamps, sizes, and system-status signals. While this is not an exploit by itself, it can create an information disclosure risk if the generated report file is stored in an insecure location, shared broadly, or later collected by other tools.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The description is written as a Chinese-only skill description and presents the skill name/interaction pattern exclusively in Chinese, with no indication that users may choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale constraint is explicitly justified.

Vague Triggers

Low

• Confidence: 80% confidence
• Finding: The README says the skill will 'automatically load' and can be used directly in conversation with the phrase 'kk每日备份汇报', but it does not clarify whether activation requires that exact phrase, close variants, or any mention of backup reporting. Without explicit trigger constraints or negative examples, the invocation scope is ambiguous for a manifest/markdown skill description.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The document presents the skill name, invocation example, output example, and usage guidance entirely in Chinese, including a Chinese trigger phrase example, with no indication that other languages are supported. For a general-purpose skill, this can amount to an implicit language constraint without user opt-in.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The summary explicitly encourages sharing backup reports and shows example output containing filenames, timestamps, and content labels such as media titles and note names. Even without direct file contents, this metadata can reveal user habits, system structure, project names, and personal interests, which is a genuine privacy and information disclosure concern.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: This shell script embeds user-facing natural language entirely in Chinese, including comments describing the command purpose and all generated report headings/messages. Under the policy rule for language/locale, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This shell skill includes natural-language help text and operational messages only in Chinese, with no opt-in or alternative locale. That creates a language/locale policy issue because users are implicitly forced into one language regardless of preference.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This shell script's natural-language comments and user-facing echo output are entirely in Chinese, including status messages and usage text. Under the language/locale policy rule, forcing a specific language without documented user choice or opt-in is a policy concern unless clearly justified as region-specific.