Global Economy Daily

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:55 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a daily market-report generator, but it documents persistent scheduled execution and contains an inactive but hard-coded QQ message recipient that could misdirect reports if delivery is enabled.

Review before installing. Only enable the LaunchAgent if you want recurring background execution, and add your own unload/removal process. Before enabling any QQ or Feishu delivery, remove the bundled QQ recipient, use one authoritative config source, and confirm the resolved destination with a dry run.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Warning

• Location: SKILL.md:64

Finding

Persistent Daily Execution Through a macOS LaunchAgent

Content

View full analysis

ProgramArguments /usr/bin/python3 {SKILL_PATH}/scripts/global_economy_daily.py StartCalendarInterval Hour7 Minute0 RunAtLoad ``` ```bash # Load the scheduled task launchctl load ~/Library/LaunchAgents/com.qclaw.global-economy-daily.plist ``` ### Technical Analysis The installation instructions direct the user to create and load a per-user macOS LaunchAgent. This establishes cross-session persistence: the configured Python script runs every day at 07:00 and also runs immediately whenever the LaunchAgent is loaded because `RunAtLoad` is enabled. Automated scheduling is related to the declared daily-report functionality, and the package does not silently install the LaunchAgent itself. Nevertheless, persistence expands the Skill's security impact beyond a single invocation. The LaunchAgent executes whichever content is present at the configured script path at execution time. No integrity check, ownership validation, immutable installation location, or pre-execution signature verification is specified. The configuration runs under the installing user's account rather than obtaining administrator privileges. It therefore does not directly escalate privileges, but it provides durable execution with all permissions already held by that user. ### Attack Path 1. A user follows `SKILL.md` and creates the LaunchAgent property-list file under `~/Library/LaunchAgents`. 2. The user runs the documented `launchctl load` command. 3. launchd registers the task and immediately invokes it because `RunAtLoad` is true. 4. launchd subsequently invokes the referenced Python file every day at 07:00. 5. If an attacker ...[truncated 864 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/global_economy_daily.py:14

Finding

Hard-Coded QQ Private-Message Recipient Identifier

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description advertises automatic report generation and delivery to QQ/Feishu, but does not clearly warn users that data will be transmitted to third-party services and fetched from Yahoo Finance. Missing disclosure weakens informed consent and can lead to unintended sharing of generated content, metadata, or operational details with external providers.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manual trigger phrase “发送每日洞察” is a natural-language command with no documented scoping, confirmation, or authorization checks. In an agent environment, broad trigger phrases can be invoked unintentionally or by unrelated conversation content, causing outbound actions such as sending reports to configured channels without clear user intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

The instruction to run launchctl load operationalizes persistent automatic execution at login/session start. While not inherently malicious, enabling persistence for a networked reporting script increases the attack surface and can cause continued outbound activity or repeated execution of a compromised script without renewed user review.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

bash

# 加载定时任务
launchctl load ~/Library/LaunchAgents/com.qclaw.global-economy-daily.plist

配置文件

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

The instruction to run launchctl load operationalizes persistent automatic execution at login/session start. While not inherently malicious, enabling persistence for a networked reporting script increases the attack surface and can cause continued outbound activity or repeated execution of a compromised script without renewed user review.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

bash

# 加载定时任务
launchctl load ~/Library/LaunchAgents/com.qclaw.global-economy-daily.plist

配置文件

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

# 定时任务（macOS launchd）
# ============================================================
LAUNCHD_LABEL = "com.qclaw.global-economy-daily"
PLIST_PATH = "~/Library/LaunchAgents/com.qclaw.global-economy-daily.plist"
SCRIPT_PATH = "~/.qclaw/workspace/skills/global-economy-daily/scripts/global_economy_daily.py"
CRON_HOUR = 7
CRON_MINUTE = 0

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

# 定时任务（macOS launchd）
# ============================================================
LAUNCHD_LABEL = "com.qclaw.global-economy-daily"
PLIST_PATH = "~/Library/LaunchAgents/com.qclaw.global-economy-daily.plist"
SCRIPT_PATH = "~/.qclaw/workspace/skills/global-economy-daily/scripts/global_economy_daily.py"
CRON_HOUR = 7
CRON_MINUTE = 0

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

# 定时任务（macOS launchd）
# ============================================================
LAUNCHD_LABEL = "com.qclaw.global-economy-daily"
PLIST_PATH = "~/Library/LaunchAgents/com.qclaw.global-economy-daily.plist"
SCRIPT_PATH = "~/.qclaw/workspace/skills/global-economy-daily/scripts/global_economy_daily.py"
CRON_HOUR = 7
CRON_MINUTE = 0

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

# 定时任务（macOS launchd）
# ============================================================
LAUNCHD_LABEL = "com.qclaw.global-economy-daily"
PLIST_PATH = "~/Library/LaunchAgents/com.qclaw.global-economy-daily.plist"
SCRIPT_PATH = "~/.qclaw/workspace/skills/global-economy-daily/scripts/global_economy_daily.py"
CRON_HOUR = 7
CRON_MINUTE = 0

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/config.py (reported line 54)May include surrounding context.

python

# 定时任务（macOS launchd）
# ============================================================
LAUNCHD_LABEL = "com.qclaw.global-economy-daily"
PLIST_PATH = "~/Library/LaunchAgents/com.qclaw.global-economy-daily.plist"
SCRIPT_PATH = "~/.qclaw/workspace/skills/global-economy-daily/scripts/global_economy_daily.py"
CRON_HOUR = 7
CRON_MINUTE = 0

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

# 定时任务（macOS launchd）
# ============================================================
LAUNCHD_LABEL = "com.qclaw.global-economy-daily"
PLIST_PATH = "~/Library/LaunchAgents/com.qclaw.global-economy-daily.plist"
SCRIPT_PATH = "~/.qclaw/workspace/skills/global-economy-daily/scripts/global_economy_daily.py"
CRON_HOUR = 7
CRON_MINUTE = 0

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/config.py (reported line 54)May include surrounding context.

python

# 定时任务（macOS launchd）
# ============================================================
LAUNCHD_LABEL = "com.qclaw.global-economy-daily"
PLIST_PATH = "~/Library/LaunchAgents/com.qclaw.global-economy-daily.plist"
SCRIPT_PATH = "~/.qclaw/workspace/skills/global-economy-daily/scripts/global_economy_daily.py"
CRON_HOUR = 7
CRON_MINUTE = 0

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The top-level documentation says the report is '每天 07:00 自动推送', implying actual scheduled message delivery. In practice, main() only generates the report and prints it, while push integration is left as a commented TODO, so the documented behavior materially overstates what the code does.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module description and all generated report content are written exclusively in Chinese, indicating the skill is designed to produce output in a fixed language. The file does not offer any user language choice or explain a region-specific requirement, which can violate language/locale policy for general-purpose skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description states the skill will '每日生成并推送' a daily global economy report in Chinese, which implies a fixed language/locale behavior. For a general-purpose global economy skill, the file does not indicate any user opt-in for Chinese output or a documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code file's human-facing documentation begins in Chinese and the surrounding comments are also Chinese, but there is no indication that the skill is intended only for Chinese-speaking users or that language selection is optional. Under the stated policy, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The comments present this section as live configuration for push behavior, including channel, target, and report time. However, the active program flow never uses these settings for delivery or scheduling; they are effectively inert because sending is commented out.

Content

No source excerpt is available for this finding.