Daily Report Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:20 AM UTC
• Version: 1.0.2

Overview

This report generator is not visibly deceptive, but it needs Review because an unsafe Git command can run arbitrary shell commands and generated HTML is not sanitized.

Review or fix the script before installing. Do not pass untrusted Git paths, CSV/JSON content, or Git commit messages to it; avoid HTML/PDF/email workflows until output escaping, path validation, and explicit send confirmation are added. Run it only in a restricted workspace with data you are comfortable including in a report.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_report.py:89

Finding

Shell Command Injection Through the Git Repository Path

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_report.py:193

Finding

Stored HTML and Script Injection in Generated Reports

Content

View full analysis

List[str]: """为每个分区生成摘要要点（本地规则引擎版）""" summaries = [] for i, item in enumerate(items[:max_items]): content = item.get("content", item.get("message", str(item))) status = item.get("status", "") author = item.get("author", "") # 构建摘要行 summary = f"- {content}" if status: summary += f"（{status}）" if author: summary += f" - {author}" summaries.append(summary) ``` ```python def format_html(self, md_content: str) -> str: """将Markdown转换为HTML""" html_template = f""" {self.config['report_title']} - {self.report_date} body {{ font-family: 'Microsoft YaHei', sans-serif; max-width: 800px; margin: 0 auto; padding: 20px; color: #333; }} h1 {{ color: #1a73e8; border-bottom: 3px solid #1a73e8; padding-bottom: 10px; }} h2 {{ color: #5f6368; margin-top: 30px; }} li {{ margin: 8px 0; }} table {{ border-collapse: collapse; width: 100%; margin: 15px 0; }} th, td {{ border: 1px solid #ddd; padding: 8px 12px; text-align: left; }} th {{ background-color: #f5f5f5; }} .meta {{ color: #666; font-size: 14px; }} .footer {{ color: #999; font-size: 12px; text-align: center; margin-top: 40px; }}

text

{md_content}

本日报由 AI 企业日报生成器自动生成 | {datetime.now().strftime('%Y-%m-%d %H:%M')}

""" return html_template ...[truncated 2453 chars]

Remediation

View remediation

{safe_content} ``` Additional hardening should include: 1. Escape `report_title` and every other configuration value inserted into HTML. 2. If true Markdown rendering is introduced, use a maintained renderer configured to disable or sanitize raw HTML. 3. Apply a restrictive Content Security Policy to generated HTML, including disabling scripts where they are unnecessary. 4. Disable JavaScript in `wkhtmltopdf`. 5. Disable local-file access and unnecessary remote-resource loading in the PDF renderer. 6. Validate or sanitize URLs if clickable links are intentionally supported. 7. Add tests for ``, script tags, event-handler attributes, SVG payloads, iframes, and malformed markup. ]]>

T08 · Insecure Dependencies

Note

• Location: claw.json:8

Finding

Unnecessary and Unpinned Third-Party Dependencies

Content

View full analysis

=3.8", "packages": ["pandas", "jinja2", "reportlab"] }, ``` From `README.md`: ```bash pip install pandas jinja2 reportlab ``` ### Technical Analysis The package declares and instructs users to install `pandas`, `jinja2`, and `reportlab` without version constraints or integrity hashes. The audited generator does not import any of these packages, making the dependency exposure unnecessary for the implemented behavior. Unpinned package installation is non-reproducible: the code installed under the same Skill version can change over time. Installation may also include transitive dependencies and package build behavior that was not reviewed with this repository. No evidence was found that the named packages are typosquatted or intentionally malicious. The issue is the avoidable and unconstrained supply-chain surface, not a confirmed compromise of those projects. ### Attack Path 1. A user installs the Skill and follows the documented `pip install` command, or the platform resolves packages from `claw.json`. 2. The package manager selects the latest versions available from its configured index. 3. It also resolves and installs transitive dependencies. 4. Any compromised, unexpectedly changed, or incompatible selected release executes its normal installation behavior and becomes available in the Skill environment. 5. This exposure occurs even though the current generator does not use the declared packages. ### Impact Assessment The immediate impact is unnecessary supply-chain exposure and loss of reproducible builds. If a resolved package or transitive dependency were compromised, installation code would execute with the privileges of the account performing the installatio ...[truncated 293 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill is presented as a report generator, but it also accesses Git history and can transmit generated content via SMTP. Those behaviors expand the data collection and exfiltration surface beyond what many users would reasonably infer from the high-level description, creating a risk of harvesting sensitive repository metadata or emailing internal content without sufficiently explicit consent.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This is a true tool-parameter abuse issue because attacker-controlled input is passed into a shell command context, enabling misuse of the Git tool invocation to execute arbitrary commands. In an agent skill, this is especially dangerous because repository paths may come from user-provided parameters or connected data sources, turning a reporting feature into code execution.

Content

Scanner excerpt · scripts/generate_report.py (reported line 90)May include surrounding context.

python

"""从Git仓库提取今日提交记录"""
        try:
            cmd = f'git -C "{repo_path}" log --since="{days} days ago" --pretty=format:"%h|%an|%s|%ad" --date=short'
            result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
            if result.returncode != 0:
                print(f"[WARN] Git仓库读取失败: {result.stderr.strip()}")
                return []

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README advertises automatic email sending even though the skill is described primarily as a report generator, expanding behavior into outbound communication and possible data exfiltration. In a skill that aggregates CSV/JSON/Git data, sending reports by email can transmit sensitive work information without clear scope boundaries, consent prompts, or recipient restrictions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill description omits a clear warning that it may collect data from multiple sources and automatically send generated reports by email. Because daily reports can include internal project status, risks, and personnel attribution, missing disclosure undermines informed consent and can lead to unintended disclosure of sensitive business information.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 36)May include surrounding context.

可选：PDF输出需要 wkhtmltopdf

Windows: choco install wkhtmltopdf

macOS: brew install wkhtmltopdf

Ubuntu: sudo apt install wkhtmltopdf

text

## 使用方法

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation phrases are broad and underspecified, which can cause the skill to trigger on generic requests like 'daily report' without confirming data sources, output format, or whether side effects such as email sending are intended. Overbroad activation increases the chance of unintended processing of local/project data and accidental execution of sensitive features.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to read input files, write output reports, and execute a Python script, but it declares no explicit tool scope or permission boundaries. That creates an authorization gap where an agent may use filesystem and shell capabilities without a clear least-privilege contract, increasing the chance of unintended file access or command execution against user-supplied paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough that normal conversation about reports or summarizing work could invoke the skill unintentionally. In this skill's context, accidental activation matters because it can lead to file access, Git inspection, script execution, and possibly email sending, turning a prompt-matching issue into a security-relevant consent problem.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill states that it collects data from multiple sources and can send email, but it does not prominently warn users that local files, JSON/CSV content, Git commit history, and generated reports may be accessed or transmitted. In an enterprise reporting context, that omission is dangerous because the accessed material is likely to contain sensitive internal project details, employee activity, or other confidential information.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest requests the "exec" permission even though the stated purpose is generating daily work reports from collected data. For a reporting skill, process execution is not inherently required and materially expands the attack surface by allowing spawned commands or auxiliary programs, which could be abused for arbitrary code execution or unauthorized local actions if the skill logic is compromised or extended unsafely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code file contains user-facing natural-language content entirely in Chinese, including the title, usage, CLI help, and generated report sections, but nowhere indicates that the tool is China-region-specific or that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest focuses on collecting data from sources and generating reports, but the implementation invokes external programs via subprocess for both git log access and wkhtmltopdf-based PDF rendering. Spawning system commands is a broader execution capability that is not stated in the manifest and is not necessary to justify at the intent level for a daily report generator.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

This is a true command-injection risk because untrusted input (repo_path) is interpolated into a shell command and executed with shell=True. An attacker who can control the repository path could inject additional shell metacharacters or commands, leading to arbitrary command execution in the agent environment.

Content

Scanner excerpt · scripts/generate_report.py (reported line 90)May include surrounding context.

python

"""从Git仓库提取今日提交记录"""
        try:
            cmd = f'git -C "{repo_path}" log --since="{days} days ago" --pretty=format:"%h|%an|%s|%ad" --date=short'
            result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
            if result.returncode != 0:
                print(f"[WARN] Git仓库读取失败: {result.stderr.strip()}")
                return []

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_report.py (reported line 281)May include surrounding context.

python

# 尝试使用 wkhtmltopdf
        try:
            subprocess.run(
                ["wkhtmltopdf", "--quiet", html_path, output_path],
                check=True,
                capture_output=True,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes collecting work data, analyzing it, and producing a structured daily report in Markdown, HTML, or PDF. This code also sends the generated report over SMTP, which is a distinct outbound communication capability not mentioned in the stated skill purpose or output formats.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The HTML formatter sets lang="zh-CN" and emits Chinese footer/content conventions, which enforces a Chinese locale in generated artifacts. Because the skill does not expose a locale choice or explain a justified regional limitation, this conflicts with the language/locale policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.