Security audit

yoooclaw-work-report-en

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can read broad private notification history and turn identifiable workplace details into shareable reports without enough user control.

Install only if you are comfortable letting the skill read raw notification history for the requested day or week. Before using it, explicitly specify the allowed apps, groups, and date range, and review/redact the generated report before sending it to a leader or posting it anywhere.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list includes very broad, natural phrases such as 'what you did today', 'work summary', and 'help me write my daily report', which can match ordinary user requests and invoke a skill that reads sensitive notification history. Because the skill subsequently accesses stored notifications across multiple apps, accidental activation can cause unexpected collection and summarization of private workplace data.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill encourages generating reports from Feishu, DingTalk, email, calendars, and other workplace notifications without clearly warning the user that sensitive message content, names, deadlines, approvals, and internal discussions may be processed. This increases the chance that users unknowingly authorize analysis of confidential or personal work data and then share the resulting summary onward.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The data-loading instructions explicitly tell the model to obtain the notification storage path and read complete daily JSON files directly from storage. That grants broad access to raw notification histories across apps, which may include confidential business messages, personal information, authentication-related notices, and other sensitive content far beyond what is necessary for a report.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill is designed to extract work progress, communication points, and to-dos from notifications and produce a briefing that can be sent to a leader or posted publicly in a workbench. Preserving and forwarding identifiable details from raw notifications creates a data-exposure path from personal device notifications to broader audiences, including leakage of internal names, projects, and sensitive discussion content.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs collection from broad categories of workplace apps and groups, and even says to automatically identify work apps from notifications if the user does not specify them. This weak minimization boundary means the skill may sweep in far more data than the user intended, including confidential chats, emails, approvals, and project alerts unrelated to the requested report.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The output instructions explicitly preserve original project names, person names, meeting names, participants, and deadlines in a summary intended for sharing. This increases the likelihood that sensitive organizational details are propagated into a broader channel, where the audience may exceed the original notification recipients.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.