Report Builder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:49 AM UTC
• Version: 0.1.0

Overview

The skill largely matches its reporting purpose, but it has under-disclosed data flows and runs unreviewed external code with broad environment access.

Review this skill before installing. It is not clearly malicious, but it should be treated as Review because it depends on external local scripts, forwards broad environment credentials to child processes, and may send extra local infrastructure-idea data plus delivery metadata beyond the obvious report payload. Prefer a version that vendors or verifies its dependencies, documents all Notion/Telegram/env requirements, uses explicit input paths, previews Telegram-bound content, and passes only minimal environment variables.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/send_report.mjs:202

Finding

Execution of Unverified Code Outside the Skill Trust Boundary

Content

View full analysis

idea.id).filter(Boolean) : [], }; await runProcessWithInput( "node", [ "/Users/dellymac/.openclaw/skills/notion-pipeline/scripts/factory_ops.mjs", "record-report-delivery", "-", ], JSON.stringify(auditPayload) ); } ``` ### Technical Analysis Both entry points execute code that is not contained in the reviewed Skill bundle. The relative import of `local_env.mjs` and the absolute invocation of `factory_ops.mjs` establish mutable dependencies outside the package's review and integrity boundary. The effective behavior of the Skill can therefore change without any modification to its audited files. In particular, the absolute path is user-specific and is not covered by the package's declared dependency metadata. An attacker or another process capable of replacing either external file could execute arbitrary JavaScript whenever the operator invokes the otherwise legitimate report commands. The delivery hook receives report metadata through standard input and executes after a successful Telegram delivery. The imported environment loader runs before argument validation in both entry points, giving substituted code an execution opportunity on every invocation ...[truncated 1157 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send_report.mjs:112

Finding

Sensitive Environment Variables Exposed to Child Processes

Content

View full analysis

{ const child = spawn("openclaw", args, { stdio: ["ignore", "pipe", "pipe"], env: process.env, }); ``` ```javascript function runProcessWithInput(command, args, input) { return new Promise((resolve, reject) => { const child = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"], env: process.env, }); ``` ### Technical Analysis Both subprocess helpers pass the entire parent environment through `env: process.env`. This occurs after `loadLocalEnv()` has run, so the inherited environment may include the Notion bearer token, Telegram configuration, database identifiers, and unrelated credentials available to the Agent. The Telegram sender does not require every environment variable held by the parent process, and the delivery-recording subprocess receives its functional input through standard input. Providing the complete environment therefore violates least privilege. There is no shell interpolation in these calls, so the issue is not shell command injection. The security risk is excessive credential exposure to external executables whose integrity is not enforced by this Skill. ### Attack Path 1. An attacker replaces or compromises the resolved `openclaw` executable, the external `factory_ops.mjs` script, or another invoked child component. 2. The operator runs `send_report.mjs`. 3. `loadLocalEnv()` populates credentials and configuration in `process.env`. 4. The compromised child process is spawned with the complete environment. 5. The child reads sensitive variables such as Notion credentials and transmits or otherwise abuses them. ### Impact Assessment A compromised child process can obtain every credential and configuration value ...[truncated 422 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/build_report.mjs:330

Finding

Undeclared Cross-Workspace Data Collection and Telegram Disclosure

Content

View full analysis

({ title: idea.title || "Untitled infrastructure idea", reason: idea.reason || idea.one_liner || "Infrastructure-focused suggestion.", notionUrl: idea.notionUrl || idea.url || null, score: idea.score ?? null, })) : []; ``` ```javascript // scripts/send_report.mjs if (Array.isArray(report.infrastructureIdeas) && report.infrastructureIdeas.length > 0) { lines.push(""); lines.push("Infra fikirleri:"); report.infrastructureIdeas.slice(0, 3).forEach((idea, index) => { const scoreText = idea.score == null ? "" : ` - ${idea.score}/100`; lines.push(`I${index + 1}. ${idea.title}${scoreText}`); if (idea.reason) { lines.push(` ${idea.reason}`); } if (idea.notionUrl) { lines.push(` ${idea.notionUrl}`); } }); } ``` ### Technical Analysis The builder automatically reads a hard-coded file from the user's OpenClaw workspace even though that file is not supplied as a command-line input and is not part of the primary report schema in `references/report-schema.md`. It extracts titles, reasons, URLs, and scores from that separate report and inserts them into the generated payload. The sender subsequently includes those values in the Telegram message. Consequently, invoking the documented build-and-send workflow can transmit information from a separate workspace file without an explicit per-run selection or ...[truncated 1656 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes Node scripts that send a Telegram report and build payloads, which implies access to environment variables and outbound network connectivity, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a least-privilege gap: an agent or runtime may grant broader capabilities than reviewers expect, increasing the risk of unintended secret access or network exfiltration if the referenced scripts are modified or behave unexpectedly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest says this skill should turn a nightly shortlist into a Telegram morning report with interactive buttons, but the code only queries Notion, reads a local infrastructure JSON file, and writes an output JSON payload to disk. There is no Telegram API integration, no message formatting for Telegram, and no approve/reject/later button generation anywhere in the implementation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/build_report.mjs (reported line 177)May include surrounding context.

js

if (!notionToken) {
    throw new Error("OPENCLAW_NOTION_TOKEN is missing");
  }
  const response = await fetch(`https://api.notion.com/v1${pathname}`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${notionToken}`,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated message content is fixed in Turkish, including headings and status text, with no option for the user to choose another language or locale. This is a natural-language policy issue because the skill imposes a specific language rather than offering opt-in or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code constructs a Telegram message from report data and sends it via the external openclaw tool, but there is no confirmation prompt, visible disclosure, or warning to the user before transmission. Because the report may contain summaries, blockers, idea details, and URLs, this is a data-transmitting network action that lacks any explicit user notice in the script.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description scopes this skill to turning a nightly shortlist into a Telegram report with approve/reject/later buttons. After sending the Telegram message, the script additionally invokes another script to record report-delivery data, which is a separate cross-system side effect not described in the skill purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The stated purpose is to turn the nightly shortlist into a Telegram morning report, but the code additionally pulls data from a hard-coded local file containing infrastructure ideas and injects those into the output. That capability is not justified by the manifest's narrow description of operating on the nightly shortlist.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The stated purpose is to turn a shortlist into a Telegram morning report. This file loads local env configuration and passes the entire environment to spawned subprocesses, introducing credential/config access beyond the manifest's narrow reporting role; while messaging may require credentials, broad env loading/inheritance is not itself part of the stated skill intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

After sending the Telegram message, the script forwards delivery metadata and idea identifiers to another script through a subprocess, yet the user is not informed that additional auditing/recording occurs. This is a secondary data-handling operation derived from the report and should be disclosed if users might not expect it.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/send_report.mjs:115

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/build_report.mjs:10