project-daily-recap

• Outcome: Review
• Latest audit: Jul 12, 2026 · 3:37 PM UTC
• Version: 1.1.0

Overview

The skill is a real daily WeChat reminder, but it installs unattended cron messaging with hardcoded recipient defaults that could send reminders to the wrong account.

Install only if you first replace the hardcoded WEIXIN_TARGET and WEIXIN_ACCOUNT with your own verified recipient/account, review the exact crontab entry, and are comfortable with a recurring job that sends through your logged-in OpenClaw messaging channel. Check the config file before running setup, and remove the cron entry manually if you stop using the skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The skill is presented as a simple daily recap reminder, but the documentation also discloses privileged side effects: modifying local configuration, reading current OpenClaw session state, writing a persistent cron job, and sending a test WeChat message. These behaviors may be functionally related to setup, but they materially change the trust and risk profile because installation performs persistence and uses session-derived messaging targets, which can surprise users and enable unintended outbound communication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The installation documentation states that setup will auto-detect login/session data, write a cron job, and send a WeChat test message, but it does not present these as security-sensitive actions requiring explicit acknowledgement. In an agent skill ecosystem, silent persistence and automatic outbound messaging increase the chance of user surprise, privacy leakage, or misuse of an already-authenticated session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script uses source "$CONFIG_FILE", which executes arbitrary shell code from a local file rather than safely parsing configuration values. If an attacker can modify that config file, they gain code execution in the context of the scheduled job, which is especially risky because cron/automation often runs unattended and may have access to messaging credentials or broader user privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The installer makes persistent changes by rewriting the local config file and installing a cron job without an explicit yes/no confirmation immediately before those actions. That behavior can surprise users, create unintended persistence, and in a skill context increases risk because scheduled execution continues after installation and may trigger messaging or other downstream actions without renewed user awareness.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The documentation explicitly says setup will write a cron task that runs daily, which establishes persistence on the host. In context this is part of the intended reminder function, but persistence combined with auto-detected session data and outbound messaging means the skill can continue operating unattended and send messages without repeated user action.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

git clone <repo-url> project-daily-recap

# 或者直接放在 skills 目录下
mkdir -p project-daily-recap
# 把文件复制进去

# 运行安装脚本

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

This code installs a persistent cron entry that executes reminder.sh daily, which is a textbook persistence mechanism. In this skill's context the persistence is part of the advertised functionality, but it is still security-relevant because scheduled execution survives the setup session and could be abused if reminder.sh or its config are later modified.

Content

Scanner excerpt · setup.sh (reported line 131)May include surrounding context.

sh

CRON_CMD="/bin/bash ${SCRIPT_DIR}/reminder.sh"
CRON_LINE="${CRON_EXPR} ${CRON_CMD}"

# 读取现有 crontab
CURRENT_CRON=$(crontab -l 2>/dev/null || true)

# 检查是否已有同一条目