Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Aloudata CAN SKILLS - scheduled-report

v1.0.0

将当前对话中已完成的分析流程,提取并固化为定时执行的任务(周报/月报/日巡检等)。本 Skill 是一个纯粹的**编排层**——它不负责定义"怎么分析",只负责"把你刚才做的分析录下来,变成能定时重放的任务"。 触发场景包括但不限于:用户提到"定时报告""定时分析""定期执行""自动报告""把这个分析变成周报""...

0· 123·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill claims to be a pure orchestration layer (recording and scheduling analysis flows) which is coherent with its instructions. However, the SKILL.md repeatedly instructs using the 'openclaw' CLI (openclaw cron add) and references Gateway searches; yet the skill metadata lists no required binaries, dependencies, or environment variables. That mismatch (instructions that require a platform binary/API but metadata claiming none) is an incoherence: the runtime will need openclaw and other platform capabilities that aren't declared.
!
Instruction Scope
The instructions direct the agent to scan the entire current conversation, extract exact query parameters/filters, assemble a fully self-contained prompt embedding those details, and create persistent scheduled tasks that will re-run that prompt. This is expected for a scheduler, but embedding raw conversation content (which may contain PII, sensitive filters, or secrets) into stored prompts is potentially risky. The doc also contains a minor inconsistency: Step 4 mandates all queries be delegated to metric-query (no direct Gateway API calls), but other parts describe '通过 Gateway 搜索相关指标' which suggests direct Gateway access—another scope mismatch.
Install Mechanism
This is instruction-only with no install steps or code files, which lowers install-supply-chain risk. However, the runtime assumes availability of platform tooling (openclaw CLI) and the metric-query/analysis skills; those are not declared in metadata. That omission is a packaging/documentation concern rather than a direct installation vulnerability.
Credentials
No environment variables or credentials are requested in metadata, which aligns with an orchestration layer. Nevertheless, because the skill instructs embedding full query parameters and user conclusions into future prompts, it may persist sensitive data (IDs, filters, or excerpts of results) into scheduled tasks. The skill provides no guidance on redaction, anonymization, or access controls for stored prompts.
Persistence & Privilege
The skill creates persistent scheduled tasks (via openclaw cron add) that will run agent-turn prompts autonomously later. 'always' is false, so it isn't force-included in every run. Autonomous scheduled execution is expected for this functionality, but the stored prompts' lifetime and access controls are unspecified—this increases blast radius if prompts contain sensitive content. Also the metadata doesn't declare that it will write temp files (e.g., /tmp) even though SKILL.md shows examples using temporary files.
What to consider before installing
This skill is conceptually what it says (it records a performed analysis and turns it into a scheduled task), but there are several things to check before installing: 1. Confirm runtime tooling and permissions: SKILL.md uses the openclaw CLI (openclaw cron add) and expects metric-query/Gateway capabilities. Verify that your environment provides these tools and that the skill's metadata should have declared them. If your environment lacks openclaw, the instructions will fail. 2. Watch for data persistence: The skill embeds conversation-derived parameters, filters, and possibly analysis outputs into the scheduled prompt. Those stored prompts will persist and run later — they can contain PII or sensitive identifiers. Ask whether scheduled task storage is encrypted, who can view/edit tasks, and whether prompts are logged or visible to admins. 3. Redaction and least privilege: Before creating schedules, insist the agent (or you) review and redact any sensitive fields (user IDs, API keys, secrets, personal data). The skill does not describe any automatic redaction. 4. Inconsistencies to clarify: The doc both prohibits direct Gateway API calls (delegating to metric-query) and elsewhere says it will search the Gateway. Ask the author which is intended and ensure the orchestration only calls approved analysis skills rather than raw APIs. 5. Test with non-sensitive data: Try creating a sample scheduled task using dummy or low-risk queries first to confirm behavior (where reports are saved, who can trigger/stop tasks, how outputs are stored). If these concerns are addressed (declare openclaw dependency, confirm storage/access controls, and add redaction guidance), the skill is more acceptable. Without that, it’s unsafe to assume the skill will not persist sensitive conversation content or attempt operations the environment isn't prepared for.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ajm3p1c6rtza1tveed12hrx83yz9z

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments