Weekly Report (OpenClaw)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:52 AM UTC
• Version: 1.0.0

Overview

The skill's weekly-report purpose is coherent, but it handles credentials and team report data with weak transport, storage, and installation safeguards that warrant review before use.

Review this before installing in any real workplace environment. Use only least-privilege test credentials at first, avoid storing secrets in project `.env` files, do not run the streamed remote installer without independent verification, and do not process confidential reports unless the report system uses HTTPS and your organization approves sending report contents to the configured LLM provider. Treat `.token_cache` and `.data_cache` as sensitive files and delete or protect them after use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (7)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup.sh:93
• Finding: Unverified Remote Installer Is Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:93-105`; also documented in `SKILL.md:54-60` **Vulnerability Type**: T03: Remote Payload Retrieval and Execution **Risk Level**: Critical ### Vulnerable Code ```bash # Install uv if [ "$IN_CHINA" = true ]; then print_info "Installing uv (may use alternative sources)..." fi # Use official installer (works in most cases) curl -LsSf https://astral.sh/uv/install.sh | sh ``` The documentation also instructs users to execute remote content directly: ```powershell irm https://astral.sh/uv/install.ps1 | iex ``` ```bash curl -LsSf https://astral.sh/uv/install.sh | sh ``` ### Technical Analysis The setup process downloads mutable content from an external URL and immediately executes it in a shell. Although `astral.sh` is presented as the official source for `uv`, the retrieved installer is not pinned to a reviewed version and is not verified using a signature or hard-coded cryptographic checksum. Consequently, the effective code executed during installation can change after this Skill has been reviewed. Compromise of the hosting infrastructure, domain, DNS resolution, certificate trust chain, or distribution process would provide an arbitrary-code execution channel. This behavior exceeds the minimum privilege necessary to install a package manager because installation can be performed using a downloaded, versioned, and independently verified artifact. ### Attack Path 1. A user or Agent invokes `scripts/setup.sh`, or follows the installation commands in `SKILL.md`. 2. The system retrieves the current contents of the remote installer URL. 3. An attacker who has compromised the distribution endpoint or relevant network trust infrastructure substitutes malicious shell code. 4. The shell executes that code immediately without an inspection or verification boundary. 5. The malicious installer gains all privileges available to the invoking user and can access files, environment variables, cre ...[truncated 404 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | sh`, `irm | iex`, and equivalent streamed-execution instructions. 2. Pin `uv` to a specific reviewed release. 3. Download the installer or binary to a local temporary file using fail-closed TLS validation. 4. Verify a hard-coded SHA-256 checksum or a trusted release signature before execution. 5. Execute only the verified local artifact. 6. Abort setup if verification fails. 7. Prefer an operating-system package manager or require users to install `uv` separately. 8. Ensure setup never requests elevated privileges for the package-manager installation itself. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/lib/config.py:11
• Finding: Credentials, Session Tokens, Cookies, and Report Data Are Transmitted over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lib/config.py:11-16`, `scripts/lib/login.py:52-53, 93-106`, `scripts/lib/fetcher.py:65-90` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: High ### Vulnerable Code The default report-system endpoint uses plaintext HTTP: ```python class SystemConfig(BaseModel): """System configuration.""" base_url: str = Field(default="http://120.210.237.117:7006/hap", description="Base URL of the weekly report system") account_id: str = Field(default="a0aadd3f-2d30-4dcd-b901-8cf689c59dc3", description="Account ID for API requests") ``` The browser navigates to that endpoint and enters the configured credentials: ```python login_url = f"{settings.system.base_url}{settings.login.login_url}" await page.goto(login_url, wait_until="networkidle") # Try to auto-fill credentials if available if settings.username and settings.password: username_input = page.locator( 'input[type="text"], input[name="username"], input[name="account"]' ) password_input = page.locator('input[type="password"]') if await username_input.count() > 0: await username_input.fill(settings.username) if await password_input.count() > 0: await password_input.fill(settings.password) ``` The authorization token and cookies are subsequently sent to the same HTTP service: ```python def _build_headers(self) -> Dict[str, str]: return { "authorization": self.token, "content-type": "application/json", "accept": "application/json", } async with httpx.AsyncClient(timeout=30.0) as client: response = await client.post( self.api_url, json=body, headers=headers, cookies=self.cookies, ) ``` ### Technical Analysis HTTP provides no transport confidentiality or server authenticity. The login page, credentials entered into it, authorization headers, cookies, request filters, and returned employee-report data ...[truncated 1232 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Migrate the report service to HTTPS with a certificate valid for a stable hostname. 2. Change the default URL to `https://` and reject all non-HTTPS report-system URLs during configuration validation. 3. Retain normal certificate and hostname verification; do not add an insecure verification bypass. 4. Mark authentication cookies as `Secure`, `HttpOnly`, and appropriately `SameSite` on the server. 5. Invalidate existing tokens and rotate credentials after migration because they may previously have crossed plaintext transport. 6. Consider short-lived, narrowly scoped tokens instead of long-lived captured browser authorization headers. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/lib/login.py:142
• Finding: Authentication Material Is Stored in an Unprotected Plaintext Cache<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lib/login.py:12-28, 142-157` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: High ### Vulnerable Code ```python # Token cache file path TOKEN_CACHE_FILE = Path(".token_cache") class LoginResult: """Result of login operation.""" def __init__(self, token: str, cookies: dict): self.token = token self.cookies = cookies def to_dict(self) -> dict: return {"token": self.token, "cookies": self.cookies} ``` ```python def save_token_cache(result: LoginResult, cache_file: Path = TOKEN_CACHE_FILE) -> None: """Save login result to cache file.""" cache_file.write_text(json.dumps(result.to_dict()), encoding="utf-8") def load_token_cache(cache_file: Path = TOKEN_CACHE_FILE) -> Optional[LoginResult]: """Load login result from cache file.""" if not cache_file.exists(): return None try: data = json.loads(cache_file.read_text(encoding="utf-8")) return LoginResult.from_dict(data) except (json.JSONDecodeError, KeyError): return None ``` ### Technical Analysis The complete authorization token and browser cookies are serialized as plaintext JSON into `.token_cache` in the current working directory. The implementation does not explicitly create the file with owner-only permissions, use an operating-system credential store, encrypt the contents, establish token expiry, or verify ownership and file type before reading it. The current directory may be shared, backed up, synchronized, or accidentally committed. File permissions depend on the process umask and surrounding directory configuration rather than an explicit security policy. The relative path also makes cache placement dependent on where the command is invoked. ### Attack Path 1. A legitimate user logs in through the Skill. 2. The Skill writes the reusable authorization token and cookies to `.token_cache`. 3. Another local account, pro ...[truncated 566 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store session material in the operating system's credential/keychain service. 2. If a file is unavoidable, place it in a private per-user cache directory rather than the current working directory. 3. Create the file atomically with owner-only mode `0600`, reject symbolic links, and verify ownership before reading. 4. Store expiry metadata and validate the session before reuse. 5. Use short-lived, least-privilege access tokens and rotate them when a cache is cleared or suspected to be exposed. 6. Add `.token_cache` to ignore rules and prevent it from entering backups or source-control archives where feasible. 7. Provide automatic cleanup on logout and after expiration. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/lib/fetcher.py:344
• Finding: Raw Employee Weekly Reports Are Persisted in a Plaintext Data Cache<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lib/fetcher.py:16-17, 344-352` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: High ### Vulnerable Code ```python # Data cache file path DATA_CACHE_FILE = Path(".data_cache") ``` ```python def _save_data_cache(self, data: List[Dict[str, Any]]) -> None: """Save fetched data to cache file.""" try: DATA_CACHE_FILE.write_text( json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8" ) except Exception as e: print(f"[Fetcher] Could not save data cache: {e}") ``` ### Technical Analysis The browser-fetch path writes the complete intercepted report rows to `.data_cache` in the current working directory. This happens without an explicit user opt-in and without field minimization, encryption, restrictive file permissions, retention limits, or secure deletion. Weekly reports may contain employee identities, work details, operational issues, plans, and other internal information. The cache is described as useful for debugging and analysis, but retaining raw records is not required to generate the current document and therefore exceeds data-minimization requirements. ### Attack Path 1. The Skill intercepts report data through the browser-fetch workflow. 2. `_save_data_cache` serializes all captured rows into plaintext JSON. 3. A local user, process, backup system, synchronization client, or accidental source-control operation accesses the file. 4. Confidential personnel and operational data is disclosed independently of report-system access controls. ### Impact Assessment The issue can disclose every report row captured during the run, including personal and internal business information. It does not directly grant additional operating-system privileges, but it bypasses the report system's access boundary by creating an unprotected local copy. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable raw-data caching by default. 2. Require an explicit diagnostic option before creating such a cache. 3. Minimize cached fields and redact names, identifiers, secrets, and unrelated report content. 4. Use a private per-user cache directory and create files atomically with mode `0600`. 5. Encrypt retained data using an operating-system-backed key where retention is necessary. 6. Apply a short retention period and delete the cache automatically after document generation or troubleshooting. 7. Ensure cache files are excluded from source control and ordinary synchronization. ]]>

other

Warning

• Location: scripts/lib/summarizer.py:227
• Finding: Internal Employee Report Content Is Disclosed to an External LLM Service<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lib/summarizer.py:227-241`; network client in `scripts/lib/llm_client.py:45-50, 69-77` **Vulnerability Type**: other: Privacy and Third-Party Data Disclosure **Risk Level**: Medium ### Vulnerable Code ```python raw_data = self._format_raw_data(data) prompt = USER_PROMPT_TEMPLATE.format( team_name=team_name, week_range=str(week_range), item_count=len(data.items), raw_data=raw_data, ) response = await self.llm_client.complete( prompt=prompt, system_prompt=SYSTEM_PROMPT, temperature=self.settings.llm.temperature, max_tokens=self.settings.llm.max_tokens, ) ``` The client sends these messages to the configured external endpoint: ```python def __init__( self, api_key: str, model: str = "deepseek-chat", base_url: str = "https://api.deepseek.com/v1", ): self.client = AsyncOpenAI(api_key=api_key, base_url=base_url) self.model = model ``` ```python response = await self.client.chat.completions.create( model=self.model, messages=messages, temperature=temperature, max_tokens=max_tokens, ) ``` ### Technical Analysis The LLM summarization feature intentionally embeds fetched weekly-report fields into a prompt and transmits that prompt to DeepSeek, OpenAI, or another configured OpenAI-compatible endpoint. This network transfer is related to the declared functionality and is documented; it is not evidence of a hidden exfiltration endpoint. Nevertheless, reports can include employee names and confidential operational details. The implementation does not request run-time confirmation, show the exact destination, apply systematic redaction, enforce an approved endpoint allowlist, or provide a local-only summarization mode. A configurable `base_url` also means data can be directed to any configured compatible service. ### Attack Path 1. The Skill fetches internal weekly-report records. 2. `_format_raw_data` converts non-excluded report f ...[truncated 726 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Obtain explicit user confirmation before transmitting report content and display the destination hostname. 2. Document what data is transmitted, why it is needed, and the provider's retention and training policies. 3. Send only fields required for summarization. 4. Redact personal identifiers, credentials, customer information, infrastructure details, and other sensitive values before constructing the prompt. 5. Add a local-model or offline summarization option. 6. Restrict `base_url` to an administrator-approved HTTPS allowlist and validate certificates. 7. Offer a preview of the outgoing prompt and an option to cancel. 8. Establish organizational approval and a data-processing agreement before sending internal reports to third parties. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/lib/generator.py:107
• Finding: Unvalidated Output Filename Allows Writes Outside the Configured Output Directory<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lib/generator.py:107-143`; input accepted at `scripts/generate.py:51-55` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium ### Vulnerable Code ```python parser.add_argument( "--output", "-o", default=None, help="Output filename" ) ``` ```python # Generate output filename if not provided if output_filename is None: week_str = str(report.week_range).replace(".", "-") team_safe = report.team_name.replace("/", "-").replace("\\", "-") output_filename = f"周报_{team_safe}_{week_str}.docx" output_path = self.output_dir / output_filename if verbose: print(f"[Generator] Output: {output_path}") # Create document doc = Document() # ... document construction omitted ... # Save document doc.save(str(output_path)) ``` ### Technical Analysis When `--output` is supplied, the value is joined directly to the configured output directory without validation. In Python's `pathlib`, an absolute right-hand operand replaces the preceding directory. Relative values containing `../` can traverse above it. The code neither verifies that the resolved destination remains under `output_dir` nor refuses to overwrite an existing file. Although the content is a generated DOCX document, the primitive permits creation or replacement of files at arbitrary writable paths selected by the caller. This becomes particularly relevant when an Agent derives command-line arguments from untrusted instructions. ### Attack Path 1. An attacker influences the value passed to `--output`. 2. The attacker supplies an absolute path or a traversal value such as `../../shared/report.docx`. 3. `self.output_dir / output_filename` resolves outside the intended report directory. 4. `doc.save` creates or overwrites the selected file using the Skill process's file-system privileges. ### Impact Assessment The attacker can create or overwrite a DOCX file at any location writable by the invo ...[truncated 212 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat `--output` strictly as a filename and reject absolute paths. 2. Reject path separators, `.`/`..` components, and names not ending in `.docx`. 3. Resolve both the output directory and target, then verify that the target is a descendant of the resolved output directory. 4. Refuse to overwrite existing files unless the user supplies a separate explicit overwrite option. 5. Consider generating a safe server-side filename and exposing only a limited report-name field. 6. Apply the same validation in both `generate` and `generate_with_template`. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/pyproject.toml:7
• Finding: Unpinned Dependencies and Mutable Package Sources Make Builds Non-Reproducible<![CDATA[ ## Vulnerability Details **File Location**: `scripts/pyproject.toml:7-17`, `scripts/setup.sh:130-140` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code ```toml dependencies = [ "playwright>=1.40.0", "httpx>=0.27.0", "python-docx>=1.1.0", "docxtpl>=0.16.0", "openai>=1.12.0", "pydantic>=2.5.0", "pydantic-settings>=2.1.0", "pyyaml>=6.0.0", "python-dotenv>=1.0.0", ] ``` ```bash install_python_deps() { print_info "Installing Python dependencies..." cd "$SCRIPT_DIR" if [ "$IN_CHINA" = true ]; then print_info "Using China PyPI mirror..." uv sync --index-url https://mirrors.aliyun.com/pypi/simple else uv sync fi print_success "Python dependencies installed" } ``` ### Technical Analysis All dependencies use open-ended minimum versions. No reviewed lockfile was present in the supplied directory structure. Therefore, installations at different times can resolve to different direct and transitive packages. The setup script may also switch the package index to a mirror based only on whether Google is reachable. This creates an additional mutable trust relationship and can be triggered by ordinary network filtering or an attacker blocking the connectivity test. There is no evidence in the reviewed files that any named dependency is currently malicious; the finding concerns preventable supply-chain exposure and non-reproducibility. ### Attack Path 1. A user runs setup after a dependency or package index has changed. 2. The resolver selects a newer direct or transitive release permitted by the `>=` constraints. 3. A compromised release or index serves malicious package content. 4. Package installation or later imports execute attacker-controlled code under the user's account. 5. The code can access the Skill's credentials, API keys, cached sessions, reports, and generated files. ### Impact Assessment A compromised dependency exec ...[truncated 243 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Generate and commit a reviewed `uv.lock` file. 2. Use exact approved versions and cryptographic hashes for deployment artifacts. 3. Review direct and transitive dependency changes through a controlled update process. 4. Use a single organization-approved package index or explicitly configured fallback policy rather than switching based on Google reachability. 5. Enable vulnerability and provenance scanning in CI. 6. Build in an isolated, least-privilege environment without report credentials or API keys. 7. Periodically update pins after security review rather than relying on unrestricted minimum-version constraints. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (63)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented behavior claims tightly scoped weekly-report automation, but the analysis indicates the implementation does not actually perform the advertised login/data-fetch/document-generation functions and instead exposes a more generic LLM capability. That mismatch is dangerous because operators may trust and authorize the skill for sensitive team-report workflows while it can behave outside the stated purpose, weakening oversight and enabling misuse of provided credentials, data, or model access.

Chaining Abuse

High

• Category: Tool Misuse

Content

irm https://astral.sh/uv/install.ps1 | iex

# 安装 uv (macOS/Linux)
curl -LsSf https://astral.sh/uv/install.sh | sh

# 安装依赖
cd skills/weekly-report/scripts

• Confidence: 93% confidence
• Finding: Piping downloaded content directly into `sh` removes any opportunity for inspection and immediately executes whatever the remote endpoint returns. In a skill that already expects credentials and local setup, this materially raises compromise risk because a successful supply-chain attack could lead to arbitrary code execution, credential theft, or persistence on the host.

Credential Access

High

• Category: Privilege Escalation

Content

$env:DEEPSEEK_API_KEY="sk-xxxxx"
```

**使用 .env 文件:**
```env
WEEKLY_REPORT_USERNAME=your_username
WEEKLY_REPORT_PASSWORD=your_password

• Confidence: 87% confidence
• Finding: The guide explicitly recommends storing a username, password, and API key in a .env file without safeguards. In practice, .env files are commonly leaked through source control, backups, support bundles, or permissive filesystem access, and these credentials could be used to access the weekly report system and associated AI provider.

Credential Access

High

• Category: Privilege Escalation

Content

model_config = SettingsConfigDict(
        env_prefix="WEEKLY_REPORT_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Chaining Abuse

High

• Category: Tool Misuse

Content

fi

    # Use official installer (works in most cases)
    curl -LsSf https://astral.sh/uv/install.sh | sh

    # Source shell profile if it exists (uv installer adds to profile)
    if [ -f "$HOME/.bashrc" ]; then

• Confidence: 99% confidence
• Finding: The pipe into sh removes any inspection barrier and turns network-delivered content directly into executable shell commands. That makes compromise of the remote source or transport immediately equivalent to arbitrary code execution on the user's machine.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares powerful capabilities via setup scripts, environment variables, shell commands, networking, and file access, but does not define any explicit tool scope or permission boundaries. That creates an authorization gap where a user or orchestrator may invoke a skill with broader powers than users would reasonably expect, increasing the risk of unintended credential use, data access, or command execution.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The description emphasizes convenience and automation but does not clearly warn that the skill will use stored credentials to log into an external report system and access team members' report data. In this context, that omission is security-relevant because users may trigger the skill without realizing it will perform authenticated actions and process potentially sensitive organizational information.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger conditions are broad enough to activate on ordinary mentions of summaries, work reports, or weekly reports, which can cause the skill to run in contexts the user did not intend. Because this skill can use credentials, network access, and team data, over-triggering increases the chance of unnecessary data access or execution of sensitive automation without clear informed consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation instructs users to place usernames, passwords, and API keys into environment variables and a .env file, but it does not warn that .env files are sensitive, should be excluded from version control, and must be protected with appropriate filesystem permissions. In a skill that automates login and uses third-party LLM APIs, these secrets enable direct account access and data exposure if mishandled.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The workflow explicitly describes capturing authorization headers and caching both tokens and cookies in local files, but provides no warning about the sensitivity of these credentials or expectations for secure storage. If those cache files are readable by other local users, included in backups, or accidentally committed, an attacker could reuse active session material to access the weekly report system as the user.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The workflow sends raw weekly report data to an external LLM API for summarization, but does not disclose the privacy implications of transmitting potentially sensitive business content and employee-related data to a third-party service. This can cause unintentional data leakage, regulatory issues, or retention of internal information outside the organization's boundary.

External Transmission

Medium

• Category: Data Exfiltration

Content

provider: Literal["deepseek", "openai"] = Field(default="deepseek", description="LLM provider")
    model: str = Field(default="deepseek-chat", description="Model name")
    base_url: str = Field(default="https://api.deepseek.com/v1", description="API base URL")
    max_tokens: int = Field(default=4000, description="Maximum tokens in response")
    temperature: float = Field(default=0.7, description="Temperature for generation")

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

provider: Literal["deepseek", "openai"] = Field(default="deepseek", description="LLM provider")
    model: str = Field(default="deepseek-chat", description="Model name")
    base_url: str = Field(default="https://api.deepseek.com/v1", description="API base URL")
    max_tokens: int = Field(default=4000, description="Maximum tokens in response")
    temperature: float = Field(default=0.7, description="Temperature for generation")

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

provider: Literal["deepseek", "openai"] = Field(default="deepseek", description="LLM provider")
    model: str = Field(default="deepseek-chat", description="Model name")
    base_url: str = Field(default="https://api.deepseek.com/v1", description="API base URL")
    max_tokens: int = Field(default=4000, description="Maximum tokens in response")
    temperature: float = Field(default=0.7, description="Temperature for generation")

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

provider: Literal["deepseek", "openai"] = Field(default="deepseek", description="LLM provider")
    model: str = Field(default="deepseek-chat", description="Model name")
    base_url: str = Field(default="https://api.deepseek.com/v1", description="API base URL")
    max_tokens: int = Field(default=4000, description="Maximum tokens in response")
    temperature: float = Field(default=0.7, description="Temperature for generation")

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

provider: Literal["deepseek", "openai"] = Field(default="deepseek", description="LLM provider")
    model: str = Field(default="deepseek-chat", description="Model name")
    base_url: str = Field(default="https://api.deepseek.com/v1", description="API base URL")
    max_tokens: int = Field(default=4000, description="Maximum tokens in response")
    temperature: float = Field(default=0.7, description="Temperature for generation")

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The defaults set the team name and member list in Chinese, which implies a fixed language/locale context in the skill's natural-language behavior. There is no indication in this file that users can opt into another language or that the locale restriction is explicitly documented as region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The display helper formats dates as `YYYY年MM月DD日`, which forces Japanese-language output. This is a natural-language/locale policy concern because the file provides no opt-in, fallback, or explanation that the skill is intended only for a Japanese locale.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code persists fetched weekly report data to a local `.data_cache` file without any access controls, retention policy, or user disclosure. Because this skill handles team weekly reports, the cached content may contain sensitive employee work summaries or internal business data that can be exposed to other local users, later processes, backups, or accidental commits.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This file embeds Chinese-only category labels and later uses Chinese titles and fonts throughout document generation, which effectively forces a specific language/locale. The policy allows locale constraints only when user choice or clear documented justification is provided, neither of which appears in this file.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This code sends arbitrary prompts and chat messages to a third-party LLM API, but there is no indication here of consent gating, redaction, or user-facing notice before potentially sensitive weekly-report data leaves the local environment. In the context of a team weekly-report skill, prompts may contain employee work summaries, internal project details, or other confidential business information, so external transmission creates a real confidentiality and compliance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

return DeepSeekClient(
            api_key=api_key,
            model=model or "gpt-4",
            base_url=base_url or "https://api.openai.com/v1",
        )
    else:
        raise ValueError(f"Unknown LLM provider: {provider}")

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The login flow intercepts outbound browser requests and extracts the authorization header, which is highly sensitive authentication material. Even if intended to automate login, collecting tokens from live network traffic increases exposure of credentials and is especially risky because this skill is designed to access a real work-reporting system containing team data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code persists a captured authentication token and all browser cookies to a local file in plaintext with no access controls, expiry handling, or user consent. If the workstation, project directory, logs, backups, or synced files are accessible to another user or process, these credentials can be reused to impersonate the user and access the reporting system.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The embedded prompt is entirely in Chinese and instructs the model to produce output in that language and format, which imposes a specific language/locale behavior. The file does not indicate that users can choose another language or that the Chinese-only constraint is a documented, region-specific requirement.

Static analysis

No suspicious patterns detected.