Weekly Report
PassAudited by ClawScan on May 1, 2026.
Overview
This weekly report skill appears benign, with the main thing to notice being that it stores your task and report history locally.
This skill is coherent with its weekly-report purpose and does not show malicious behavior in the provided artifacts. Before installing, be aware that task names and report history are saved locally in tasks.json and reports.json, so avoid storing confidential work information unless that is acceptable.
Findings (1)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Work tasks and report history entered into the skill can remain stored locally after the conversation ends.
The skill saves user task text and generated report metadata to persistent local JSON files; SKILL.md also discloses tasks.json and reports.json as data storage.
tasks: path.join(SKILL_DIR, 'tasks.json'), reports: path.join(SKILL_DIR, 'reports.json') ... fs.writeFileSync(FILES[type], JSON.stringify(data, null, 2));
Do not enter highly sensitive work details unless you are comfortable with them being stored in the skill directory; delete the JSON files if you want to clear the history.