ClawHub
Back to skill

Security audit

日报生成器 Daily Report Pro

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward daily-report drafting skill, with ordinary privacy cautions around workplace details and personalization memory.

Use this skill for drafting daily work reports, but avoid giving it confidential customer data, unreleased business plans, or sensitive internal project details unless your workplace permits that. Allow file reads and writes only for specific notes and report locations you intend to use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill states it will remember the user's work background, project names, terminology, and prior report style without any visible notice, consent flow, retention limit, or control surface. In a workplace-reporting context, this can accumulate sensitive professional data and behavioral profiling, creating privacy risk through over-collection, unintended retention, or later disclosure in generated outputs.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill claims it will learn from user feedback, remember terminology and preferences, and continuously improve based on user data, but it does not warn users that their inputs may contribute to persistent profiling or adaptation. Because daily reports can contain internal project details, blockers, staffing dependencies, and business context, undisclosed learning/retention increases the chance of privacy harm and enterprise information leakage.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.