周计划自动分配日程器

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:05 AM UTC
• Version: 1.1.0

Overview

This skill is a disclosed weekly planning automation, but it sets up recurring jobs that can keep reading business plans and send full daily plans through Feishu without fresh confirmation.

Install only if you want unattended OpenClaw cron jobs to manage these plan files and send full daily-plan contents through your configured Feishu channel. Before enabling cron, confirm the exact plan directories, Feishu destination, retention needs, and how you will remove or pause all three jobs.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: SKILL.md:173

Finding

Persistent Scheduled Agent Tasks with Recurring File Access and Plan Transmission

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

声明描述的是一个完整的“周计划→5个日计划→定时推送”的自动化系统，而给出的代码仅覆盖其中的一个子功能：复制下周周计划文件，并做少量内容变换。此外，该脚本还会读取日计划目录并将勾选完成的子步骤合并回当前周计划，这属于描述中未明确提及的行为。虽然声明里提到“周五复制”是完整工作流的一部分，但本代码块本身不足以支撑其核心宣称能力，因此描述与实际代码行为存在明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The core primary purpose largely matches: this script does split a weekly plan into five daily plans and supports file reading/writing. However, the declared description promises a broader workflow with Feishu webhook push, three cron jobs, and Friday copy/Sunday split/Sunday–Thursday push automation. In the actual code chunk, there is no network/webhook logic, no scheduler/cron configuration, and no Friday copy implementation. The '--push' mode merely reads the next day's file and prints it to stdout between BEGIN/END markers, which is materially different from pushing to Feishu. Therefore the description overstates implemented capabilities relative to this code chunk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

编辑 `split_weekly.js` 第 27-28 行：

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 319)May include surrounding context.

md

`copy_next_week_plan.js` 已加自动补章节逻辑：

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file is entirely written in Chinese and does not provide an alternative language option or explain that the skill is intentionally limited to Chinese-speaking users or a China-specific environment. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The skill explicitly instructs persistent storage of planning data under user directories and the OpenClaw workspace, including weekly/daily plans that may contain customer names, locations, deadlines, and strategy notes. Session persistence of sensitive operational data increases exposure to local compromise, overbroad syncing to cloud drives, accidental retention, and leakage through backups or other tools that access the workspace.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

bash

# 推荐路径（可改成任意同步盘）
mkdir -p "${NOTES_DIR}/001周工作计划"
mkdir -p "${NOTES_DIR}/002日工作计划"

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document earlier acknowledges that pushed daily plans may contain client names, deadlines, locations, assignees, and strategy notes, but later claims the Feishu push 'does not involve privacy data.' That contradiction can mislead users into enabling external transmission of sensitive business information under false assumptions, increasing the chance of unauthorized disclosure or compliance violations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code embeds Chinese-only natural-language descriptions and later emits Chinese-only console messages and generated markdown content, indicating the skill forces a specific language/locale. The policy allows locale constraints only when clearly documented and justified or when users are offered a choice, neither of which is present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstring at L476-L480 says the first priority is putting temporary/communication work earlier in the week, and the inline comment at L483-L491 says allocation should follow user time tags. However, the actual code at L493-L499 initializes to Friday and then uses Math.min over dayTagMap, which selects the earliest tagged day rather than the documented 'latest' tag, contradicting the stated intent of using the latest deadline-like tag.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Multiple sections describe the workflow as '每天 15:00 推送次日计划' or '推送次日工作计划' (L015, L097-L100, L184-L190, L483), but L416 describes the cron as '早上推送当天计划'. This is an active intent/documentation contradiction about what the automation actually sends.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The markdown explicitly states the timezone as "Asia/Shanghai" for cron configuration, and the setup examples consistently hard-code that locale. This can violate language/locale policy expectations because the skill does not offer opt-in or explain that users may choose a different timezone based on their environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script’s natural-language documentation is entirely in Chinese, and its user-facing console messages are also emitted only in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale violation unless the regional constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.