Ai Intelligent Report Generator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:16 AM UTC
• Version: 1.0.0

Overview

This report-generator skill is coherent in purpose, but it needs review because its install instructions run unpinned code downloaded from an external repository.

Review the external repository and dependencies before installing, prefer a pinned commit and isolated environment, and only enable scheduled email/report sending after confirming recipients, data contents, and disable controls.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:40

Finding

Mutable Remote Code and Unpinned Dependencies Are Retrieved and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40-43
Vulnerability Type: Remote payload retrieval and insecure dependency execution
Risk Level: High

Complete Code Snippet:

bash

git clone https://github.com/openclaw-skills/ai-intelligent-report-generator
cd ai-intelligent-report-generator
pip install -r requirements.txt
python app.py

Technical Analysis

The audited package contains only SKILL.md and does not include the application source, requirements.txt, or app.py. Its installation instructions retrieve the effective implementation from an external Git repository without pinning a reviewed commit, tag, or cryptographic digest. The remote repository can therefore change after this skill has been reviewed.

The instructions also install an unavailable and unaudited dependency manifest. Python package installation can execute package build or installation logic, while subsequently running app.py executes the remotely retrieved application directly. Neither the application behavior nor its transitive dependencies can be verified from the audited artifact.

This creates a mutable remote execution path and an unsafe supply-chain boundary. The evidence does not establish that the current remote repository or dependencies are malicious, but following the documented procedure permits externally controlled code to execute without integrity verification.

Attack Path

1. A user follows the installation commands in SKILL.md.
2. Git clones the current state of the externally hosted repository rather than a specifically reviewed commit.
3. An attacker who compromises the repository, its maintainer account, or the relevant upstream branch modifies requirements.txt, app.py, or other imported modules.
4. pip install -r requirements.txt resolves and installs the externally selected dependencies; package installation or build hooks may execute attacker-controlled code.
5. `python ...[truncated 727 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete application source, dependency manifest, and entry point in the skill package so reviewers can inspect the code that will execute.
2. If remote retrieval is unavoidable, pin the Git checkout to a fully qualified, reviewed commit hash rather than a mutable default branch.
3. Verify the retrieved source using a trusted signature or an independently distributed cryptographic checksum before installation or execution.
4. Replace unconstrained dependency installation with a lockfile containing exact versions and hashes, and require hash verification during installation.
5. Audit all direct and transitive dependencies, use trusted package indexes explicitly, and prevent dependency fallback to untrusted sources.
6. Separate installation from execution. Do not instruct users to run the application automatically before they have reviewed and verified the downloaded files.
7. Run installation and execution in an isolated, least-privileged virtual environment or container without unnecessary credentials, host mounts, or network access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill advertises automatic sending behavior ('定时发送/自动发送') but provides no warning, consent model, destination controls, or explanation of what data may leave the system. For a report generator that may process financial, project, or analytical content, silent outbound delivery increases the risk of unintended disclosure of sensitive information through email or other integrations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description and all user-facing markdown content are written in Chinese, but the file does not indicate that the skill is region-specific or that users can opt into this language. This may conflict with language/locale policy expectations when a skill is intended for general availability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.