Daily Report Skill

Daily report skill - Generate and send daily work summary. Keywords: daily report, work summary, end of day. Use when: End of day reporting, or manually trig...

Security Scan

The skill's functionality (reading local memory and sending reports to messaging channels) matches its description, but it omits how API credentials/endpoints are provided and gives vague instructions that could allow broad access to conversation logs or send data to external messaging APIs without clear safeguards.

Purpose & Capability

The skill claims to generate and send daily reports which legitimately requires reading local notes and calling messaging APIs. However, the package declares no environment credentials or config requirements for authenticating to Feishu/Discord/Slack/Telegram; the provided config example only shows recipient IDs, not API keys or webhook URLs. That mismatch (capability to send messages vs. no declared way to authenticate) is unexplained.

Instruction Scope

Runtime instructions tell the agent to read memory/YYYY-MM-DD.md and 'conversation logs, task status (optional)'. Reading conversation logs can expose broad sensitive context; the SKILL.md gives no limits on which logs or how much context to include. Instructions to 'call corresponding message API per channel type' are vague about endpoints and authentication, leaving implementation and data handling decisions unspecified and potentially risky.

Install Mechanism

This is an instruction-only skill with no install spec and no code files, so it does not write or execute new artifacts on disk on install — low install-surface risk.

Credentials

No required environment variables or primary credential are declared, yet the skill expects to send messages through external services which normally require tokens, webhooks, or bot credentials. The example config does not include credentials or webhook URLs. This under-specification could lead to credentials being added to workspace config in an ad-hoc, insecure way or the agent being configured to use globally available tokens unexpectedly.

Persistence & Privilege

The skill is not always-enabled and does not request special platform privileges. It writes reports into workspace memory paths under its own scope (memory/daily-reports/) and does not claim to modify other skill configs.

What to consider before installing

Before installing, clarify how messaging credentials are supplied and stored (webhook URL, bot token, or platform-specific credentials) and avoid putting secrets in plain workspace files. Confirm exactly which conversation logs/files the agent will read and restrict that to only what's necessary for the report. If the skill will send messages automatically (cron), test it in a sandboxed workspace or with a test recipient to ensure no sensitive data is leaked. Ask the publisher for explicit documentation of required auth fields and recommended secure storage (e.g., secret manager or platform-provided credentials) — the absence of declared credentials in the package is the main gap here.

Trigger

• Configure via OpenClaw cron to auto-execute at your preferred time
• Or manual trigger: "generate daily report"

Workflow

1. Load config

   • Read config/daily-report.json (workspace root)
   • Fall back to defaults or prompt user if missing
   • See references/config.example.md

2. Collect data

   • Read memory/YYYY-MM-DD.md (today's journal)
   • Read conversation logs, task status (optional)

3. Generate report

   • Load template: assets/template.md
   • Replace variables: {{date}}, {{time}}, {{recipient}}, {{agent_name}}
   • Fill sections: work, learning, review, suggestions, evolution

4. Save file

   • Write to memory/daily-reports/YYYY-MM-DD.md

5. Send notification

   • Iterate through configured channels
   • Call corresponding message API per channel type
   • Supports parallel multi-channel delivery

Configuration

Config file: config/daily-report.json (workspace root, not included in skill package)

Required fields:

• recipient.name - Report recipient name
• channels - Notification channels (at least one)
• agent_name - Agent name

See references/config.example.md for details.

Template

Report template at assets/template.md

Supported variables:

• {{date}} - Date (YYYY-MM-DD)
• {{time}} - Time (HH:MM)
• {{recipient}} - Recipient name
• {{agent_name}} - Agent name

Manual Invocation

generate daily report

Or with temporary overrides:

generate daily report and send to feishu ou_xxx