quantum-daily-tracker

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill appears purpose-aligned: it tracks public quantum-paper RSS feeds and writes local Markdown notes, with disclosed low-risk scheduling and state tracking to notice.

This looks safe for its stated purpose. Before installing or enabling it, confirm whether you want a daily scheduled task, keep generated files inside a dedicated quantum-tracker workspace, and review the dashboard/notes it updates.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI10: Rogue Agents

What this means

If the user configures scheduling, the skill may run repeatedly and create or update notes even when the user is not actively prompting it.

Why it was flagged

The artifact explicitly describes recurring scheduled execution and automatic catch-up. This is consistent with a daily tracker, but it is still persistent/autonomous behavior the user should opt into.

Skill content

- **执行时间**: 每天早上 7:00 (Asia/Shanghai)
- **任务类型**: cron job (每天执行)
- **漏补机制**: 自动检测上次执行日期，漏掉的天数会自动补充

Recommendation

Only enable the cron/scheduled workflow if desired, keep it scoped to the intended project directory, and make sure there is an easy way to pause or disable it.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The skill can add or update local Markdown notes and dashboard content, which may affect an existing workspace if paths overlap.

Why it was flagged

The workflow includes local file creation and dashboard updates. These mutations are central to the skill’s purpose, but users should notice that it is not read-only.

Skill content

5. 为重要论文生成笔记，保存到对应来源目录
6. 汇总当日热点生成每日速览
7. 更新 Dashboard：将近7天的论文滚动显示在 Dashboard 中

Recommendation

Run it in a dedicated quantum-tracker folder or review the target paths before allowing automated updates.

Info

#ASI06: Memory and Context Poisoning

What this means

If the marker file is incorrect or edited, the tracker may skip days or backfill extra days.

Why it was flagged

The skill uses a persistent local state file to decide what dates to process. This appears limited to a last-run date and is purpose-aligned, but it can influence future runs.

Skill content

1. 检查 `memory/last-run.txt` 获取上次执行日期（不存在则从7天前开始）
8. 更新 `memory/last-run.txt`

Recommendation

Keep the memory file in the project directory and allow users to inspect or reset it when results look wrong.