ClawHub
Back to skill

Security audit

weekly-report-auto

Security checks for vulnerabilities and agentic risk

Overview

This skill reads local weekly Markdown work notes to draft a weekly report, and that behavior is disclosed and aligned with its stated purpose.

Install only if you are comfortable with the agent reading current-week .md daily report files from the configured WorkBuddyFile weekly folders. Review that folder for sensitive business or personal content before using broad requests like '生成周报' or '整理本周工作'.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger phrases are very broad workplace expressions such as '生成周报' and '整理本周工作', which can easily appear in normal conversation and cause the skill to activate unintentionally. Because the skill then performs automatic local file discovery and reading, accidental activation can expose or process sensitive local work notes without a clear, fresh user confirmation.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill is designed to automatically recurse through a fixed local path and read all matching Markdown files for the current week, but it does not clearly present this as a consented local data access operation at runtime. In context, these files are workplace daily reports and may contain sensitive business information, so silent or poorly disclosed bulk access increases confidentiality and privacy risk.

Static analysis

No suspicious patterns detected.