Morning Briefing

PassAudited by VirusTotal on May 7, 2026.

Overview

Type: OpenClaw Skill Name: daily-briefing-wps Version: 1.0.0 The skill is designed to automate a daily project briefing by reading local markdown logs (MEMORY.md) and querying a WPS calendar via the 'mcporter' CLI tool. It includes standard instructions for the agent to format reports and configure a recurring cron job. All actions, including file access and tool execution, are transparently documented and strictly aligned with the stated purpose of generating a morning status update.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If enabled, the agent can send a morning briefing every day in the main session.

Why it was flagged

The skill explicitly uses a persistent scheduled task to run daily and send a briefing. This is aligned with the skill purpose, but it means the agent may act without a fresh user prompt each morning.

Skill content
每天 09:00 Asia/Shanghai 触发... openclaw cron add --session main --schedule "0 9 * * *"
Recommendation

Only create or keep the cron job if you want automatic daily messages, and know how to list or remove the cron job if you no longer need it.

What this means

Private project status, pending items, or inaccurate memory entries may appear in the daily briefing.

Why it was flagged

The briefing is generated from persistent memory and work-log files. That is expected for this skill, but stale, sensitive, or incorrect entries could be reused in the generated message.

Skill content
读取 MEMORY.md(核心索引)... 读取今天和昨天的日志文件(`memory/YYYY-MM-DD.md`)... 提取 `#pending` 标签的条目
Recommendation

Keep MEMORY.md and daily logs scoped, avoid storing secrets there, and periodically review the memory content that drives the briefing.

What this means

If WPS access is configured, the agent can read today's calendar events for inclusion in the briefing.

Why it was flagged

The skill can use an account-backed WPS calendar integration through an external config. This is purpose-aligned and scoped to today's events, but metadata does not declare a WPS credential or config requirement.

Skill content
(可选)调用 WPS 日历查今日日程: mcporter --config skills/wps-cli/mcporter.json call 'ksc-mcp-wps.mcp_calendar.list_events(...)'
Recommendation

Confirm which WPS account/config is used and ensure it has only the access needed for calendar lookup.

What this means

The behavior and permissions of the WPS helper depend on a separate local integration not reviewed here.

Why it was flagged

The optional WPS call relies on an external mcporter/WPS CLI configuration that is not included in the supplied files and is not declared in requirements. This is not suspicious by itself, but the external integration is outside the reviewed artifact set.

Skill content
mcporter --config skills/wps-cli/mcporter.json call 'ksc-mcp-wps.mcp_calendar.list_events(...)'
Recommendation

Review the referenced WPS CLI/MCP configuration before relying on the optional calendar feature.