ClawHub
Back to skill

Security audit

weekly-report-pro

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local weekly/monthly report helper that reads user-directed Git history and optional checklist files, with no evidence of hidden upload, destructive behavior, or persistence.

Install this only if you are comfortable letting the agent read Git commit history, file paths, code-change counts, and any checklist or exported work materials you explicitly provide. Prefer pointing it at specific project folders instead of broad home directories, and review generated summaries for sensitive project names or commit text before sharing.

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill instructs the agent to read local files and invoke a shell-based Python script, but it declares no corresponding permissions. That creates a transparency and policy-enforcement gap: users and the platform may not realize the skill can access repository contents and plan files from the local machine. In this context, the data access is related to the skill’s purpose, which makes it less suspicious than arbitrary file access, but still risky because it touches potentially sensitive source code and work artifacts.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The skill description promises a full local weekly/monthly report generator with role templates, formatting modes, and synthesis of user-supplied materials, but the implemented behavior reportedly only collects and emits raw JSON. This mismatch is dangerous because users may disclose sensitive work information, chat exports, or todos expecting constrained local report generation, while the actual behavior does not meet the advertised workflow or safeguards. Security review and user consent depend on accurate descriptions, so a capability gap like this undermines trust and safe use.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger examples are broad and include common phrases like '周报', '写周报', and '本周工作总结', which can easily appear in ordinary conversation and cause the skill to activate unintentionally. Because this skill auto-collects local Git history, code statistics, and optionally reads local Markdown plan files, accidental invocation can expose sensitive project metadata and work patterns beyond what the user intended to share in that moment.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger phrases include very broad everyday expressions such as '周报' and '月度总结', which can overlap with normal conversation and cause the skill to activate unexpectedly. In this skill, accidental activation is more concerning because activation can lead to local repository scanning and file reading, exposing sensitive project metadata without the user intending to invoke those actions.

Unvalidated Output Injection

High
Category
Output Handling
Content
if author:
        cmd += ["--author", author]
    try:
        out = subprocess.run(cmd, capture_output=True, text=True,
                             timeout=GIT_TIMEOUT_SECONDS).stdout.strip()
    except (subprocess.TimeoutExpired, OSError):
        return []
Confidence
78% confidence
Finding
Commit messages come from an untrusted local Git repository and are copied verbatim into the JSON output. If a downstream agent, terminal renderer, markdown formatter, or report generator later embeds these strings without escaping, an attacker-controlled commit message could inject terminal escape sequences, markdown content, or prompt-influencing text into the next processing stage.

Static analysis

No suspicious patterns detected.