Wework Financial Daily
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: wework-financial-daily Version: 1.0.0 The skill bundle exhibits high-risk data handling and credential management practices. The main script `scripts/generate_and_send.py` contains hardcoded credentials for a remote MinIO server (IP: `1.15.115.88`) and automatically uploads generated reports to this server, making them accessible to the infrastructure owner. Furthermore, it routes sensitive Enterprise WeChat tokens (`WEWORK_X_TOKEN`) through a non-official third-party API gateway (`kd.chatedu.jiaxutech.com`), which poses a significant risk of credential harvesting. While these behaviors are functionally linked to the stated goal of generating and sharing reports, the reliance on hardcoded remote storage and third-party intermediaries for sensitive data is highly suspicious.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Running the skill as-is could use fixed service accounts or send reports to an unintended recipient, and the exposed storage keys may allow unauthorized access to the MinIO bucket.
The script embeds credential-like values and a recipient account directly in source code instead of relying only on user-provided environment variables; the registry metadata also declares no credentials.
X_TOKEN = "eyJhbGciOiJI" ... TO_USER = "18018517752" ... MINIO_ACCESS_KEY = "gWDVHdO8sAba6LTNSLCd" ... MINIO_SECRET_KEY = "wi2ZRu3ewRJaOqdZKKDW90l9SPjNYwEqiitHKK1g"
Remove hardcoded secrets and recipient values, rotate the exposed keys, require user-supplied environment variables, and declare the required credentials in metadata.
Generated reports are made publicly accessible through an HTTP link; if the report is later customized to include real or private business data, that data could be exposed.
The script uploads the generated HTML report to an external MinIO server, disables TLS, and sets the bucket policy to public read.
MINIO_ENDPOINT = "1.15.115.88:9000" ... MINIO_SECURE = False ... "Principal": {"AWS": "*"} ... public_url = f"http://{MINIO_ENDPOINT}/{bucket_name}/{safe_file_name}"Clearly disclose the external storage destination, use HTTPS, avoid public-read buckets by default, and require explicit user consent before uploading or sharing reports.
The script would keep running automatically with elevated authority, increasing the impact if the script, dependencies, or configuration are later changed or compromised.
The documentation recommends a persistent daily scheduled task that runs even when the user is not logged in and with highest privileges.
在属性中勾选： - ✅ "不管用户是否登录都要运行" - ✅ "使用最高权限运行"
Create the scheduled task under a least-privileged user, do not enable highest privileges unless strictly necessary, and provide clear disable/removal steps.
Users may be asked to trust or look for helper files that were not included in the reviewed package, and the skill may fail or require extra packages not documented.
The instructions reference helper scripts for running and scheduled-task setup, but those files are not present in the supplied manifest; the documented dependency list also omits the visible MinIO import.
直接双击 `一键运行.bat` ... 右键点击 `SetupTask.ps1` ... 脚本会自动检查并安装以下 Python 包
Include all referenced helper files in the reviewed package, document every dependency, and avoid asking users to run unreviewed admin scripts.
Users might mistake synthetic prices and indicators for real market data if the generated report is not clearly labeled.
The code generates simulated market data, while parts of the user-facing description describe latest daily BTC/AAPL financial data.
# 生成当日最新模拟金融数据（使用日期作为种子，保证当日数据一致）
Label all generated outputs as simulated unless real data APIs are integrated, and avoid presenting synthetic values as latest market prices.