智能报告生成器

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill’s reporting purpose is coherent, but it encourages automatic Feishu output from potentially sensitive data sources without clear scope, recipients, or approval boundaries.

Before installing, decide exactly which files, Feishu tables, and database queries the skill may use. Do not enable automatic sending until the Feishu destination, sharing permissions, and review process are clear.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

Reports could be sent or created in a Feishu workspace automatically, potentially before the user has checked the contents or destination.

Why it was flagged

The skill recommends automatic sending to Feishu as the default output path, but does not specify user approval, destination, sharing permissions, or review before publication.

Skill content

- Default Output: feishu_doc
- Auto Send: true

Recommendation

Require explicit confirmation before each external send, and document the exact Feishu destination, sharing scope, and whether reports can be edited or deleted afterward.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

Sensitive local or business data could be included in generated reports and placed into an external workspace without clearly documented limits.

Why it was flagged

The skill may move data from files, Feishu tables, JSON, and database query results into Feishu documents, but the artifacts do not define data boundaries, allowed sources, destinations, or retention.

Skill content

- 飞书多维表格
- CSV/Excel 文件
- JSON 数据
- 数据库查询结果
...
- 飞书文档

Recommendation

Limit allowed input paths and database scopes, require the user to choose the output destination, and document what data is sent to Feishu and how it is retained.

Low

#ASI03: Identity and Privilege Abuse

What this means

If connected with broad Feishu or database access, the skill may be able to read more business data than intended for a single report.

Why it was flagged

Using Feishu tables and database query results likely requires account or database privileges; this is purpose-aligned, but the artifacts do not describe credential scope or least-privilege setup.

Skill content

飞书多维表格 ... 数据库查询结果

Recommendation

Use least-privilege Feishu/database credentials, restrict access to specific tables or queries, and avoid granting broad workspace or database permissions.