Daily Report Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:17 AM UTC
• Version: 1.0.0

Overview

This daily report skill is understandable, but it can automatically read workspace notes or logs and send summaries to external chat recipients without clearly defined approval or recipient controls.

Review this skill before installing. Use it only with a narrowly scoped config, trusted pre-approved recipients, and explicit opt-in for any conversation-log access. Avoid cron delivery unless reports are previewed or redacted and destination changes require confirmation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24
• Finding: Unbounded Sensitive Data Collection and External Delivery## Vulnerability Details **File Location**: `SKILL.md`, lines 24–25 and 34–37 **Vulnerability Type**: Sensitive information exposure through insufficiently scoped collection and external transmission **Risk Level**: Medium **Vulnerable Code Snippet**: ```md 2. **Collect data** - Read `memory/YYYY-MM-DD.md` (today's journal) - Read conversation logs, task status (optional) 5. **Send notification** - Iterate through configured `channels` - Call corresponding message API per channel type - Supports parallel multi-channel delivery ``` ### Technical Analysis The skill instructs the agent to collect information from a daily journal and optionally from conversation logs and task records, then transmit the generated report through third-party messaging channels. It does not define boundaries for conversation-log collection, data minimization rules, secret detection, personal-data redaction, recipient verification, or a mandatory review step before transmission. Conversation logs and workspace memory can contain credentials, access tokens, private messages, internal project information, or personal data. Without explicit filtering and approval controls, such information may be reproduced in a generated report and sent outside the local workspace. This is an insecure workflow design rather than evidence of intentional data theft. Exploitation depends on sensitive content being present in the collected sources and subsequently included by the report-generation process. ### Attack Path 1. Sensitive information is written to the current journal, conversation history, or task records. 2. The daily-report workflow reads those sources. 3. The report generator summarizes or copies the sensitive information into the report. 4. The workflow iterates over the configured external messaging channels. 5. The generated report is transmitted without a required redacted preview or explicit approval. 6. A configured th ...[truncated 621 chars]
• Remediation: ## Remediation Suggestions - Default collection to the current daily journal only. - Require explicit user authorization before accessing conversation logs or task records. - Define precise source, date, conversation, and field boundaries for every collection operation. - Scan generated content for credentials, tokens, private keys, personal data, and other sensitive material. - Redact or omit detected sensitive information before saving or transmitting the report. - Display a redacted report preview and the exact channel and recipient before external delivery. - Require explicit confirmation for each delivery unless the destination and disclosure policy were previously approved. - Apply channel-specific access controls and maintain an audit record of the sources read, redactions performed, and destinations used.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:71
• Finding: Arbitrary Notification Recipient Override Without Validation## Vulnerability Details **File Location**: `SKILL.md`, lines 71–73 **Vulnerability Type**: Unvalidated external recipient override **Risk Level**: Medium **Vulnerable Code Snippet**: ```md Or with temporary overrides: ``` generate daily report and send to feishu ou_xxx ``` ``` ### Technical Analysis The documented manual invocation permits the configured delivery destination to be replaced with a recipient identifier supplied directly in the request. No requirement is specified to validate the identifier against an approved recipient list, verify ownership, constrain temporary overrides, or obtain confirmation before sending. Because the report can contain information collected from workspace memory and conversation records, destination integrity is a security boundary. Accepting an arbitrary destination identifier creates a confused-deputy condition in which an injected or mistaken instruction can cause the agent to deliver sensitive information to an unauthorized account. The project contains no executable implementation, so the exact runtime validation behavior cannot be verified. The finding applies to the documented workflow, which expressly supports overrides without documenting corresponding controls. ### Attack Path 1. An attacker introduces an instruction containing an attacker-controlled Feishu recipient ID, or a user accidentally supplies the wrong ID. 2. The skill interprets the request as a valid temporary destination override. 3. The skill collects daily journal, task, or conversation information and generates the report. 4. The configured trusted destination is replaced with the supplied identifier. 5. The messaging API sends the report to the unauthorized recipient. ### Impact Assessment The attacker could receive the contents of the generated daily report, including any sensitive workspace information incorporated into it. This does not provide local code execution or elevated system privile ...[truncated 311 chars]
• Remediation: ## Remediation Suggestions - Permit delivery only to recipients and channels defined in an authenticated, pre-approved configuration. - Reject arbitrary recipient identifiers supplied through natural-language invocations by default. - If temporary overrides are necessary, require an explicit privileged setting to enable them. - Validate the destination against an allowlist and enforce the expected identifier format for each channel. - Show the resolved channel, recipient name, recipient identifier, and redacted report preview before delivery. - Require explicit user confirmation whenever the destination differs from the configured default. - Record destination changes and delivery attempts in an audit log without storing message credentials or sensitive report contents.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Trigger

- Configure via OpenClaw cron to auto-execute at your preferred time
- Or manual trigger: "generate daily report"

## Workflow

• Confidence: 90% confidence
• Finding: The skill supports cron-based auto-execution for generating and sending reports, which enables autonomous transmission of workspace-derived content without a fresh user review at send time. In the context of reading memory files and optional conversation logs, automation materially increases the chance of unintended disclosure, stale misconfiguration, or repeated leakage to external channels.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly reads today's journal and optionally conversation logs, then sends generated content through configured external channels, but the description does not clearly warn users about this data flow. This creates a real privacy and data-exfiltration risk because users may invoke or schedule the skill without understanding that potentially sensitive internal content will be transmitted outside the workspace.

Vague Triggers

Low

• Confidence: 85% confidence
• Finding: The manifest defines a manual trigger as "generate daily report" without clarifying scope, negative examples, or where the phrase should be used. While somewhat domain-specific, the file does not specify constraints that distinguish intentional invocation from ordinary conversational use in broader chat contexts.

Static analysis

No suspicious patterns detected.