Aloudata CAN SKILLS - scheduled-report

Security checks across static analysis, malware telemetry, and agentic risk

Overview

This skill is purpose-aligned for creating user-confirmed recurring analysis reports, but users should review the saved prompt and schedule because it creates an enabled recurring agent task.

Before installing or using this skill, confirm that you want an enabled recurring agent job, carefully review the generated prompt and cron schedule, and remove any sensitive or one-time-only context from the scheduled task.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI10: Rogue Agents
Low
What this means

A report job can keep running automatically until the user disables or deletes it.

Why it was flagged

The core workflow creates an enabled recurring agent task that will execute the stored prompt in future sessions.

Skill content
openclaw cron add --name "<任务名称>" --cron "<Cron表达式>" --agent-turn "<prompt>" ... `--enabled` | 默认不传(自动启用)
Recommendation

Only approve creation after reviewing the schedule and prompt; use the listed disable/remove commands when the task is no longer needed.

#
ASI06: Memory and Context Poisoning
Low
What this means

Business analysis details or sensitive context from the conversation may be stored in the scheduled task and replayed later.

Why it was flagged

The skill persists selected conversation-derived analysis steps, query parameters, and user judgments into a future reusable prompt.

Skill content
回顾当前对话的全部历史,**原样提取**用户实际执行过的每一个分析步骤。 ... **完全自包含** ... 所有信息必须写入 prompt。
Recommendation

Review the generated configuration and prompt, and remove confidential, temporary, or untrusted content before confirming.

#
ASI02: Tool Misuse and Exploitation
Low
What this means

Incorrect quoting or unexpected text in the generated prompt or name could create the wrong scheduled task or cause command-line handling problems.

Why it was flagged

The skill uses a local CLI command with generated task names and prompts; this is necessary for scheduling but should be handled carefully.

Skill content
如果 prompt 过长导致命令行传参困难,先将 prompt 写入临时文件再传入: ... openclaw cron add --name "销售业绩周报" --cron "0 9 * * 1" --agent-turn "$(cat /tmp/task_prompt.txt)"
Recommendation

Prefer structured tool invocation or robust escaping, and review the exact task details before execution.