Weekly Report (OpenClaw)

自动化工作周报生成系统。支持自动登录周报系统、获取团队周报数据、使用 AI 进行内容提炼总结、生成格式化的 Word 文档。 触发场景：(1) 用户要求生成周报 (2) 用户询问本周/上周工作总结 (3) 用户提到"周报"、"weekly report"、"工作总结" (4) 用户需要汇总团队成员工作内容

Security Scan

The skill's code and runtime instructions mostly match a weekly-report generator, but there are several inconsistencies and operational risks (hard-coded service endpoint, network-intercepting login, and a setup script that runs external installers) that warrant caution before installing or providing credentials.

Purpose & Capability

The code implements the stated purpose (login, fetch reports, summarize with an LLM, generate a Word doc). Requesting a site username/password and an LLM API key is consistent with the feature set. However, registry metadata earlier listed no required env vars while SKILL.md and the code clearly require WEEKLY_REPORT_USERNAME, WEEKLY_REPORT_PASSWORD, and DEEPSEEK_API_KEY — this metadata mismatch is unexpected and should be resolved.

Instruction Scope

Login code uses Playwright to observe network requests and capture an authorization header (it looks for a substring like 'md_pss_id'), and it restores cookies and intercepts API responses to extract data. Capturing network requests and saving tokens/cookies is invasive by design (to obtain auth), but it also means the skill can capture any authorization headers visible in that browser session. The SKILL.md instructs running a setup script and provides commands that will install tooling and run Playwright; these steps expand the runtime scope beyond simple API calls.

Install Mechanism

There is no platform-level install spec in the registry, but SKILL.md requires running scripts/setup.sh (and provides curl|sh / powershell install snippets). The manual instructions include piping installers from external URLs (e.g., astral.sh for 'uv') and running Playwright installer commands. Running curl | sh / remote PowerShell and installing browser runtimes is higher risk: it downloads and executes code from external hosts outside the skill bundle. Review scripts/setup.sh before running and prefer installing dependencies from trusted package managers.

Credentials

The environment variables requested by the skill (WEEKLY_REPORT_USERNAME, WEEKLY_REPORT_PASSWORD, DEEPSEEK_API_KEY) are plausible for logging into a report system and calling an LLM. However, the default configuration contains a hard-coded base_url that points to an IP (http://120.210.237.117:7006/hap) and embedded worksheet/app/view IDs. That means credentials you supply will be used to access that specific host by default — verify this is the intended target before providing sensitive credentials. Also the registry metadata omitted environment requirements, which is inconsistent.

Persistence & Privilege

The skill does not request 'always: true' and does not modify other skills. It caches tokens and data in local files (.token_cache, .data_cache) in the working directory — expected for this tool but note persisted tokens/cookies are stored on disk. No system-wide configuration changes are requested by the code.

What to consider before installing

This skill largely does what it says, but take precautions before installing or running it: - Inspect scripts/setup.sh before running; it uses remote installers (curl|sh / PowerShell) which can execute arbitrary code. Prefer manual, vetted installation of dependencies. - Verify and, if needed, change the configured base_url and API IDs: defaults point to a specific IP (http://120.210.237.117:7006) and app/worksheet/view IDs — supplying your corporate credentials without confirming the endpoint could leak access to that host. - Be aware the login routine intercepts network requests and saves the authorization header and cookies to .token_cache. Run the tool in an isolated environment (VM or container) if you must provide real credentials, and delete cache files after use. - If you don't trust the hard-coded defaults, pass an explicit config file (--config) that points to your own instance or remove the default values. - Consider creating a limited-permission service account for the report system and a dedicated LLM API key rather than using a full-privilege personal credential. If you want, I can: (1) summarize exactly what setup.sh does, (2) list the external domains the scripts download from, or (3) produce a checklist of safe install steps (run in VM, inspect files, run in offline mode) to reduce risk.

Weekly Report - 周报自动生成系统

自动化工作周报生成工具，支持从周报系统获取数据、AI 智能总结、生成 Word 文档。

快速开始

1. 环境准备

首次使用前，运行自动安装脚本配置环境：

Windows (PowerShell):

cd skills/weekly-report/scripts
./setup.ps1

macOS / Linux (Bash):

cd skills/weekly-report/scripts
chmod +x setup.sh
./setup.sh

安装脚本会自动检测并安装：

• Python 3.10+ (需要预先安装)
• uv 包管理器
• Python 依赖包
• Playwright Chromium 浏览器

国内用户: 脚本会自动检测网络环境，在无法访问 Google 时使用国内镜像源加速下载。

<details> <summary>手动安装（可选）</summary>

如果不想使用自动脚本，可以手动安装：

# 安装 uv (Windows)
irm https://astral.sh/uv/install.ps1 | iex

# 安装 uv (macOS/Linux)
curl -LsSf https://astral.sh/uv/install.sh | sh

# 安装依赖
cd skills/weekly-report/scripts
uv sync

# 安装 Playwright Chromium
uv run playwright install chromium
uv run playwright install-deps chromium  # Linux 需要

</details>

2. 配置环境变量

export WEEKLY_REPORT_USERNAME="your_username"
export WEEKLY_REPORT_PASSWORD="your_password"
export DEEPSEEK_API_KEY="your_api_key"

3. 生成周报

# 生成本周周报
uv run python generate.py --week today

# 生成上周周报
uv run python generate.py --week last

# 生成指定日期所在周的周报
uv run python generate.py --week 2026-03-07

命令说明

generate.py - 生成周报

主脚本，执行完整的周报生成流程。

python generate.py [OPTIONS]

选项：

• --week, -w: 周日期，支持 today（本周）、last（上周）、YYYY-MM-DD（指定日期）
• --team, -t: 团队名称，默认使用配置中的团队
• --output, -o: 输出文件名，不指定则自动生成
• --force-login, -f: 强制重新登录，不使用缓存的 token
• --headless: 无头模式运行浏览器
• --verbose, -v: 详细输出模式

输出格式（JSON）：

{
  "success": true,
  "output_file": "output/周报_科创研发组_2026-03-02-2026-03-08.docx",
  "items_count": 25,
  "filtered_count": 25,
  "week_range": "2026.03.02-2026.03.08"
}

login.py - 登录管理

单独执行登录操作，用于获取和缓存认证 token。

python login.py [OPTIONS]

选项：

• --force, -f: 强制重新登录
• --headless, -H: 无头模式

输出格式（JSON）：

{
  "success": true,
  "message": "Login successful, token cached"
}

工作分类说明

周报内容按以下分类整理：

分类	说明
人才转型	AI培训、技能学习、人才培养
自主开发	自主开发的应用、工具、系统
科创支撑	专利申报、创新项目、科创制度
AI架构及网运安全自智规划	AI架构、监控智能化、态势感知
系统需求规划建设	系统需求分析、平台建设、系统规划
综合工作	日常运维、综合事务、其他

团队成员配置

可在 config/settings.yaml 或通过 --team-members 参数配置团队成员列表，只有列表中的成员周报会被包含在最终文档中。

示例用法

# 生成科创研发组本周周报
uv run python generate.py --team "科创研发组" --week today

# 强制重新登录后生成上周周报
uv run python generate.py --week last --force-login

# 无头模式生成周报（适用于 CI/CD）
uv run python generate.py --week today --headless

# 指定输出文件名
uv run python generate.py --week today --output "周报_2026年第10周.docx"

详细文档

• 配置说明
• 工作流程