Security audit

Weekly Report (OpenClaw)

Security checks for vulnerabilities and agentic risk

Overview

The skill's weekly-report purpose is coherent, but it handles credentials and team report data with weak transport, storage, and installation safeguards that warrant review before use.

Review this before installing in any real workplace environment. Use only least-privilege test credentials at first, avoid storing secrets in project `.env` files, do not run the streamed remote installer without independent verification, and do not process confidential reports unless the report system uses HTTPS and your organization approves sending report contents to the configured LLM provider. Treat `.token_cache` and `.data_cache` as sensitive files and delete or protect them after use.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (7)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/setup.sh:93
Finding: Unverified Remote Installer Is Piped Directly into a Shell
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/lib/config.py:11
Finding: Credentials, Session Tokens, Cookies, and Report Data Are Transmitted over Plaintext HTTP
Content: View full analysis
0: await username_input.fill(settings.username) if await password_input.count() > 0: await password_input.fill(settings.password) ``` The authorization token and cookies are subsequently sent to the same HTTP service: ```python def _build_headers(self) -> Dict[str, str]: return { "authorization": self.token, "content-type": "application/json", "accept": "application/json", } async with httpx.AsyncClient(timeout=30.0) as client: response = await client.post( self.api_url, json=body, headers=headers, cookies=self.cookies, ) ``` ### Technical Analysis HTTP provides no transport confidentiality or server authenticity. The login page, credentials entered into it, authorization headers, cookies, request filters, and returned employee-report data ...[truncated 1232 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/lib/login.py:142
Finding: Authentication Material Is Stored in an Unprotected Plaintext Cache
Content: View full analysis
dict: return {"token": self.token, "cookies": self.cookies} ``` ```python def save_token_cache(result: LoginResult, cache_file: Path = TOKEN_CACHE_FILE) -> None: """Save login result to cache file.""" cache_file.write_text(json.dumps(result.to_dict()), encoding="utf-8") def load_token_cache(cache_file: Path = TOKEN_CACHE_FILE) -> Optional[LoginResult]: """Load login result from cache file.""" if not cache_file.exists(): return None try: data = json.loads(cache_file.read_text(encoding="utf-8")) return LoginResult.from_dict(data) except (json.JSONDecodeError, KeyError): return None ``` ### Technical Analysis The complete authorization token and browser cookies are serialized as plaintext JSON into `.token_cache` in the current working directory. The implementation does not explicitly create the file with owner-only permissions, use an operating-system credential store, encrypt the contents, establish token expiry, or verify ownership and file type before reading it. The current directory may be shared, backed up, synchronized, or accidentally committed. File permissions depend on the process umask and surrounding directory configuration rather than an explicit security policy. The relative path also makes cache placement dependent on where the command is invoked. ### Attack Path 1. A legitimate user logs in through the Skill. 2. The Skill writes the reusable authorization token and cookies to `.token_cache`. 3. Another local account, pro ...[truncated 566 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/lib/fetcher.py:344
Finding: Raw Employee Weekly Reports Are Persisted in a Plaintext Data Cache
Content: View full analysis
None: """Save fetched data to cache file.""" try: DATA_CACHE_FILE.write_text( json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8" ) except Exception as e: print(f"[Fetcher] Could not save data cache: {e}") ``` ### Technical Analysis The browser-fetch path writes the complete intercepted report rows to `.data_cache` in the current working directory. This happens without an explicit user opt-in and without field minimization, encryption, restrictive file permissions, retention limits, or secure deletion. Weekly reports may contain employee identities, work details, operational issues, plans, and other internal information. The cache is described as useful for debugging and analysis, but retaining raw records is not required to generate the current document and therefore exceeds data-minimization requirements. ### Attack Path 1. The Skill intercepts report data through the browser-fetch workflow. 2. `_save_data_cache` serializes all captured rows into plaintext JSON. 3. A local user, process, backup system, synchronization client, or accidental source-control operation accesses the file. 4. Confidential personnel and operational data is disclosed independently of report-system access controls. ### Impact Assessment The issue can disclose every report row captured during the run, including personal and internal business information. It does not directly grant additional operating-system privileges, but it bypasses the report system's access boundary by creating an unprotected local copy. ]]>
Remediation: View remediation

other

Warning

Location: scripts/lib/summarizer.py:227
Finding: Internal Employee Report Content Is Disclosed to an External LLM Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/lib/generator.py:107
Finding: Unvalidated Output Filename Allows Writes Outside the Configured Output Directory
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/pyproject.toml:7
Finding: Unpinned Dependencies and Mutable Package Sources Make Builds Non-Reproducible
Content: View full analysis
=1.40.0", "httpx>=0.27.0", "python-docx>=1.1.0", "docxtpl>=0.16.0", "openai>=1.12.0", "pydantic>=2.5.0", "pydantic-settings>=2.1.0", "pyyaml>=6.0.0", "python-dotenv>=1.0.0", ] ``` ```bash install_python_deps() { print_info "Installing Python dependencies..." cd "$SCRIPT_DIR" if [ "$IN_CHINA" = true ]; then print_info "Using China PyPI mirror..." uv sync --index-url https://mirrors.aliyun.com/pypi/simple else uv sync fi print_success "Python dependencies installed" } ``` ### Technical Analysis All dependencies use open-ended minimum versions. No reviewed lockfile was present in the supplied directory structure. Therefore, installations at different times can resolve to different direct and transitive packages. The setup script may also switch the package index to a mirror based only on whether Google is reachable. This creates an additional mutable trust relationship and can be triggered by ordinary network filtering or an attacker blocking the connectivity test. There is no evidence in the reviewed files that any named dependency is currently malicious; the finding concerns preventable supply-chain exposure and non-reproducibility. ### Attack Path 1. A user runs setup after a dependency or package index has changed. 2. The resolver selects a newer direct or transitive release permitted by the `>=` constraints. 3. A compromised release or index serves malicious package content. 4. Package installation or later imports execute attacker-controlled code under the user's account. 5. The code can access the Skill's credentials, API keys, cached sessions, reports, and generated files. ### Impact Assessment A compromised dependency exec ...[truncated 243 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (63)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented behavior claims tightly scoped weekly-report automation, but the analysis indicates the implementation does not actually perform the advertised login/data-fetch/document-generation functions and instead exposes a more generic LLM capability. That mismatch is dangerous because operators may trust and authorize the skill for sensitive team-report workflows while it can behave outside the stated purpose, weakening oversight and enabling misuse of provided credentials, data, or model access.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: Piping downloaded content directly into sh removes any opportunity for inspection and immediately executes whatever the remote endpoint returns. In a skill that already expects credentials and local setup, this materially raises compromise risk because a successful supply-chain attack could lead to arbitrary code execution, credential theft, or persistence on the host.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
irm https://astral.sh/uv/install.ps1 | iex # 安装 uv (macOS/Linux) curl -LsSf https://astral.sh/uv/install.sh | sh # 安装依赖 cd skills/weekly-report/scripts

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: The guide explicitly recommends storing a username, password, and API key in a .env file without safeguards. In practice, .env files are commonly leaked through source control, backups, support bundles, or permissive filesystem access, and these credentials could be used to access the weekly report system and associated AI provider.
Content: Scanner excerpt · references/configuration.md (reported line 37)May include surrounding context.
$env:DEEPSEEK_API_KEY="sk-xxxxx"

text
**使用 .env 文件:** ```env WEEKLY_REPORT_USERNAME=your_username WEEKLY_REPORT_PASSWORD=your_password

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/lib/config.py (reported line 63)May include surrounding context.
python
model_config = SettingsConfigDict( env_prefix="WEEKLY_REPORT_", env_file=".env", env_file_encoding="utf-8", extra="ignore", )

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The pipe into sh removes any inspection barrier and turns network-delivered content directly into executable shell commands. That makes compromise of the remote source or transport immediately equivalent to arbitrary code execution on the user's machine.
Content: Scanner excerpt · scripts/setup.sh (reported line 105)May include surrounding context.
sh
fi # Use official installer (works in most cases) curl -LsSf https://astral.sh/uv/install.sh | sh # Source shell profile if it exists (uv installer adds to profile) if [ -f "$HOME/.bashrc" ]; then

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares powerful capabilities via setup scripts, environment variables, shell commands, networking, and file access, but does not define any explicit tool scope or permission boundaries. That creates an authorization gap where a user or orchestrator may invoke a skill with broader powers than users would reasonably expect, increasing the risk of unintended credential use, data access, or command execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description emphasizes convenience and automation but does not clearly warn that the skill will use stored credentials to log into an external report system and access team members' report data. In this context, that omission is security-relevant because users may trigger the skill without realizing it will perform authenticated actions and process potentially sensitive organizational information.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger conditions are broad enough to activate on ordinary mentions of summaries, work reports, or weekly reports, which can cause the skill to run in contexts the user did not intend. Because this skill can use credentials, network access, and team data, over-triggering increases the chance of unnecessary data access or execution of sensitive automation without clear informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation instructs users to place usernames, passwords, and API keys into environment variables and a .env file, but it does not warn that .env files are sensitive, should be excluded from version control, and must be protected with appropriate filesystem permissions. In a skill that automates login and uses third-party LLM APIs, these secrets enable direct account access and data exposure if mishandled.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow explicitly describes capturing authorization headers and caching both tokens and cookies in local files, but provides no warning about the sensitivity of these credentials or expectations for secure storage. If those cache files are readable by other local users, included in backups, or accidentally committed, an attacker could reuse active session material to access the weekly report system as the user.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The workflow sends raw weekly report data to an external LLM API for summarization, but does not disclose the privacy implications of transmitting potentially sensitive business content and employee-related data to a third-party service. This can cause unintentional data leakage, regulatory issues, or retention of internal information outside the organization's boundary.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/configuration.md (reported line 70)May include surrounding context.
md
provider: Literal["deepseek", "openai"] = Field(default="deepseek", description="LLM provider") model: str = Field(default="deepseek-chat", description="Model name") base_url: str = Field(default="https://api.deepseek.com/v1", description="API base URL") max_tokens: int = Field(default=4000, description="Maximum tokens in response") temperature: float = Field(default=0.7, description="Temperature for generation")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/configuration.md (reported line 120)May include surrounding context.
md
provider: Literal["deepseek", "openai"] = Field(default="deepseek", description="LLM provider") model: str = Field(default="deepseek-chat", description="Model name") base_url: str = Field(default="https://api.deepseek.com/v1", description="API base URL") max_tokens: int = Field(default=4000, description="Maximum tokens in response") temperature: float = Field(default=0.7, description="Temperature for generation")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/lib/config.py (reported line 41)May include surrounding context.
python
provider: Literal["deepseek", "openai"] = Field(default="deepseek", description="LLM provider") model: str = Field(default="deepseek-chat", description="Model name") base_url: str = Field(default="https://api.deepseek.com/v1", description="API base URL") max_tokens: int = Field(default=4000, description="Maximum tokens in response") temperature: float = Field(default=0.7, description="Temperature for generation")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/lib/llm_client.py (reported line 47)May include surrounding context.
python
provider: Literal["deepseek", "openai"] = Field(default="deepseek", description="LLM provider") model: str = Field(default="deepseek-chat", description="Model name") base_url: str = Field(default="https://api.deepseek.com/v1", description="API base URL") max_tokens: int = Field(default=4000, description="Maximum tokens in response") temperature: float = Field(default=0.7, description="Temperature for generation")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/lib/llm_client.py (reported line 102)May include surrounding context.
python
provider: Literal["deepseek", "openai"] = Field(default="deepseek", description="LLM provider") model: str = Field(default="deepseek-chat", description="Model name") base_url: str = Field(default="https://api.deepseek.com/v1", description="API base URL") max_tokens: int = Field(default=4000, description="Maximum tokens in response") temperature: float = Field(default=0.7, description="Temperature for generation")

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The defaults set the team name and member list in Chinese, which implies a fixed language/locale context in the skill's natural-language behavior. There is no indication in this file that users can opt into another language or that the locale restriction is explicitly documented as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The display helper formats dates as YYYY年MM月DD日, which forces Japanese-language output. This is a natural-language/locale policy concern because the file provides no opt-in, fallback, or explanation that the skill is intended only for a Japanese locale.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code persists fetched weekly report data to a local .data_cache file without any access controls, retention policy, or user disclosure. Because this skill handles team weekly reports, the cached content may contain sensitive employee work summaries or internal business data that can be exposed to other local users, later processes, backups, or accidental commits.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This file embeds Chinese-only category labels and later uses Chinese titles and fonts throughout document generation, which effectively forces a specific language/locale. The policy allows locale constraints only when user choice or clear documented justification is provided, neither of which appears in this file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code sends arbitrary prompts and chat messages to a third-party LLM API, but there is no indication here of consent gating, redaction, or user-facing notice before potentially sensitive weekly-report data leaves the local environment. In the context of a team weekly-report skill, prompts may contain employee work summaries, internal project details, or other confidential business information, so external transmission creates a real confidentiality and compliance risk.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/lib/llm_client.py (reported line 108)May include surrounding context.
python
return DeepSeekClient( api_key=api_key, model=model or "gpt-4", base_url=base_url or "https://api.openai.com/v1", ) else: raise ValueError(f"Unknown LLM provider: {provider}")

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The login flow intercepts outbound browser requests and extracts the authorization header, which is highly sensitive authentication material. Even if intended to automate login, collecting tokens from live network traffic increases exposure of credentials and is especially risky because this skill is designed to access a real work-reporting system containing team data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code persists a captured authentication token and all browser cookies to a local file in plaintext with no access controls, expiry handling, or user consent. If the workstation, project directory, logs, backups, or synced files are accessible to another user or process, these credentials can be reused to impersonate the user and access the reporting system.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The embedded prompt is entirely in Chinese and instructs the model to produce output in that language and format, which imposes a specific language/locale behavior. The file does not indicate that users can choose another language or that the Chinese-only constraint is a documented, region-specific requirement.
Content: No source excerpt is available for this finding.