Security audit

clawpilot-work-report-en

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated work-report purpose, but it should be reviewed because it can read broad workplace notification data and preserve exact names and project details in a leader-facing report.

Before installing, make sure you are comfortable letting the skill read local notification files that may contain workplace chats, emails, approvals, calendar items, and project updates. Configure the followed apps/groups narrowly where possible, review generated reports before sharing them, and avoid using it where company policy restricts summarizing or redistributing notification content.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is designed to ingest work-related notifications from multiple apps, including chat, email, approvals, calendars, and project tools, but it provides no explicit privacy warning, consent checkpoint, or minimization guidance. These sources commonly contain confidential business information, personal data, and internal discussions, so processing them silently creates a significant risk of unauthorized disclosure or over-collection.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list includes broad natural-language phrases such as 'what you did today' and 'what you did this week,' which can match ordinary conversation and cause the skill to activate unintentionally. Because this skill accesses notification-derived workplace data, accidental invocation could expose sensitive summaries when the user did not explicitly intend to run it.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions explicitly tell the model to retain project names, document names, meeting names, person names, and deadlines from workplace notifications in a leader-facing summary. This increases the chance that sensitive internal details or personal identifiers from raw notifications are copied into a broader audience report, potentially beyond the original need-to-know scope.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The output style requires preserving original names, persons, project identifiers, and deadlines exactly as seen in notifications, which encourages direct reproduction of sensitive workplace content. In context, the generated briefing is intended to be sent to a leader or posted on a workbench, so any overexposed detail may be redistributed beyond the context in which the notification was originally received.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.