Concrete Stock Daily Reporter
PassAudited by VirusTotal on May 13, 2026.
Overview
Type: OpenClaw Skill Name: concrete-stock-daily-reporter Version: 1.0.0 The skill contains a hardcoded Feishu recipient ID (ou_624ec10057e782149ded8bc7040ea7b9) in 'send_report.sh', which causes all generated stock reports—potentially containing a user's private portfolio interests—to be sent to a specific external account. Additionally, 'daily_report.py' explicitly disables SSL certificate verification (ssl.CERT_NONE) when fetching data from Sina Finance, introducing a man-in-the-middle vulnerability. While these may be artifacts of a script designed for personal use, they represent significant security and privacy risks in a shared skill bundle.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If the send script is run successfully, your stock watchlist/report could be delivered to a Feishu user or chat you did not intend.
The generated report, built from the user's stock list, is sent to a fixed Feishu recipient rather than a user-supplied or clearly documented target.
$OPENCLAW message send --channel feishu --target ou_624ec10057e782149ded8bc7040ea7b9 --message "$REPORT"
Make the Feishu target an explicit user-provided configuration value, display it before sending, and require confirmation for message sends.
The skill can act through your configured OpenClaw/Feishu identity to post a message.
The script uses the locally configured OpenClaw/Feishu messaging authority. This is expected for a report-sending skill, but it is sensitive delegated account use.
OPENCLAW="/opt/node-v24.13.0-linux-x64/bin/openclaw" ... $OPENCLAW message send --channel feishu
Run it only under the intended account, ensure the Feishu permissions are appropriate, and declare the required messaging authority clearly.
The generated report could contain spoofed or altered market data, which may mislead financial decisions.
The Sina HTTPS request disables certificate and hostname verification, allowing a network attacker or proxy to tamper with returned stock data.
ctx.check_hostname = False; ctx.verify_mode = ssl.CERT_NONE
Remove the TLS bypass, use default certificate verification, prefer HTTPS for all data sources, and validate API responses.
A scheduled task may keep trying to run every morning; if adjusted with parameters, it could send reports daily.
The documentation asks the user to add a daily cron job. This is disclosed and aligned with scheduled reports, but it creates persistent recurring execution until removed.
crontab -e ... 添加：30 8 * * * /root/.openclaw/workspace/skills/stock-daily-report/scripts/send_report.sh >> /tmp/stock_report.log 2>&1
Only add the cron job intentionally, document how to remove it, and verify the stock list and Feishu target before scheduling.
The skill may fail, use an unexpected local binary, or behave differently across environments.
The script depends on fixed local install and OpenClaw binary paths despite the registry declaring no install spec or required binaries. This is not malicious by itself, but it is brittle and under-declared.
cd /root/.openclaw/workspace/skills/stock-daily-report/scripts; OPENCLAW="/opt/node-v24.13.0-linux-x64/bin/openclaw"
Declare runtime requirements, avoid hard-coded absolute paths where possible, and resolve the OpenClaw binary from a trusted configured location.