Daily Report Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:58 AM UTC
• Version: 1.0.0

Overview

The skill is a report generator, but it asks the agent to automatically gather broad memory, Git, workspace, and optional API data without enough scoping or privacy controls.

Review this skill before installing if your memory files, repositories, task notes, or reports may contain confidential, customer, personal, or proprietary information. Use it only with explicit source limits, preview the files and date ranges before generation, redact sensitive content, and require separate confirmation before creating or sending Feishu or other external-shareable output.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:12

Finding

Overbroad Automatic Access to Agent Memory and Workspace Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12, 37-38, 134-143, and 161
Vulnerability Type: Excessive access to persistent memory, task state, repository history, and project files
Risk Level: Medium

Vulnerable Skill Instructions

The following is a faithful English rendering of the relevant source segments:

markdown

- Zero-input data collection — Automatically reads work logs, memory files, and Git records without requiring manual input.

text

Work traces collected automatically:
- memory/ logs
- MEMORY.md memory
- Git commit records
- Project file changes

markdown

| Data source                    | Daily | Weekly | Monthly | Project |
|--------------------------------|:-----:|:------:|:-------:|:-------:|
| memory/YYYY-MM-DD.md           | Yes   | 7 days | Month   | Yes     |
| MEMORY.md long-term memory     | Yes   | Yes    | Yes     | Yes     |
| Git commit records             | Yes   | Yes    | No      | No      |
| Project directory files        | No    | No     | No      | Yes     |
| HEARTBEAT.md task status       | Yes   | No     | No      | No      |
| User-provided content          | Yes   | Yes    | Yes     | Yes     |

markdown

- Data sources: Specify additional files or APIs.

Technical Analysis

The Skill directs the hosting agent to collect information automatically from several potentially sensitive sources, including persistent MEMORY.md content, dated memory logs, Git history, project-directory files, and HEARTBEAT.md. It also permits unspecified additional files or APIs to be selected as data sources.

These instructions do not establish path allowlists, source-by-source consent, sensitivity filtering, project boundaries, or least-privilege restrictions. Consequently, a simple report-generation request may cause the agent to inspect information beyond the content explicitly supplied by the user and beyond what is ...[truncated 1977 chars]

Remediation

View remediation

Remediation Suggestions

1. Default to content explicitly supplied by the user rather than automatically scanning memory or workspace data.
2. Require explicit, source-by-source approval before reading MEMORY.md, HEARTBEAT.md, Git history, project files, or external APIs.
3. Display the exact paths, repositories, date ranges, and API sources that will be accessed before collection begins.
4. Restrict filesystem access to user-approved directories and reject traversal outside those boundaries.
5. Apply the shortest necessary date range and avoid loading complete long-term memory for a daily or weekly report.
6. Add filtering for secrets, credentials, personal information, customer data, internal URLs, and unrelated memory entries.
7. Present a source and redaction preview before producing a final report.
8. Require separate confirmation before preparing output intended for an external recipient or collaboration platform.
9. Record which sources contributed to each generated report so users can audit unintended inclusion.
10. Remove or constrain the open-ended option to use unspecified additional files or APIs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description promises a complete automated reporting skill that synthesizes work logs/memory into日报、周报、月报 with multiple output formats and templates. The supplied code does none of that. It is only a helper script for calculating dates and formatting date displays via CLI commands such as today, week, last7, and display. While date calculation could be a supporting component of a reporting tool, this code chunk by itself materially differs from the declared primary purpose and lacks the core reporting, summarization, data access, and output-generation behavior described.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list is very broad and includes common phrases such as '日报', '周报', '今天做了什么', and '工作总结', which can cause unintended activation during normal conversation. In this skill's context, unintended invocation is more dangerous because activation is advertised as automatically reading work logs, memory files, Git history, and other potentially sensitive local data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill prominently advertises 'zero-input' automatic collection from logs, memory, Git records, and project files, but does not present a clear warning that these sources may contain confidential, proprietary, or personal data. This is dangerous because users may invoke the skill expecting convenience while unaware that it could aggregate sensitive content into a reportable form.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

L017 explicitly states the skill has no external dependencies and uses only local file reads with no API calls. However, elsewhere the same file claims it can output Feishu cards (L015, L152) and even accept '额外文件或API' as data sources (L161), which extends behavior beyond purely local file reading and contradicts the stated implementation scope.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This is an active documentation contradiction, not just an omission: L017 promises local-only, no-API behavior, while L152 and L161 describe report delivery to Feishu and use of additional API data sources. These statements cannot all be true at once without qualification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The example invocations remain ambiguous and encourage activation from ordinary phrases rather than a clearly bounded command syntax. Because the skill is designed to auto-collect and summarize work artifacts, accidental triggering could expose or process sensitive project information the user did not intend to include.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow description normalizes fully automatic aggregation from memory and log files without emphasizing the risk of pulling in unrelated or sensitive content. In this context, hierarchical summarization increases the danger because private details from daily artifacts can be propagated into broader weekly or monthly reports, amplifying accidental disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Documenting Feishu output without a strong warning creates a real risk of external disclosure, since generated reports may contain sensitive internal data aggregated from local sources. The combination of automatic data collection and one-step external formatting/sharing materially increases the chance of unintentional data exfiltration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file contains a section titled "English Daily Report" that presents an English-only reporting template. Under the policy rules, forcing a specific language without user opt-in can be a natural-language policy violation, and this section does not explicitly state that English is optional or user-selected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The natural-language formatting function sets lang = "zh" as the default, which forces Chinese locale output unless the caller explicitly changes it. This is a language/locale policy concern because the skill does not offer user choice at the CLI level or document consent for the default language behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.