ClawHub
Back to skill

Security audit

Smart Report Generator

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent report generator with advertised AI and webhook integrations, but users should avoid sending sensitive task or report data without reviewing the destinations.

Install only in an isolated environment with reviewed dependency versions. Before using weekly reports or webhook delivery, check whether task data contains customer, employee, financial, roadmap, incident, or other confidential information, and confirm that the OpenClaw AI service and webhook destination are approved for that data. Do not use the advertised monthly, Slack, WeCom, scheduling, or template features unless the publisher implements them.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
report_bot.py:67
Finding

Prompt Injection Through Untrusted Task Data

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:23
Finding

Unpinned and Incomplete Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

other

Warning
Location
report_bot.py:67
Finding

Potentially Sensitive Task Data Is Sent to an External AI Service Without an Explicit Privacy Boundary

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation promotes scheduled delivery of generated reports to external IM platforms via webhooks, but it provides no warning that report contents may contain sensitive business data and will be transmitted to third-party services. In a reporting automation skill, this omission increases the risk of accidental data leakage because users may enable push delivery without considering data classification, retention, or audience exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file-level description, report templates, prompts, and CLI messages are all hard-coded in Chinese, which imposes a specific language on users. The policy allows locale constraints only when opt-in or clearly justified, neither of which is present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The top-level docstring states 'AI 自动生成日报/周报/月报' (daily/weekly/monthly reports), and the CLI help at L126 also advertises 'monthly'. However, generate_from_tasks only implements daily and weekly; any other type falls through without producing a report. This is an active contradiction between documented capability and code behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

In weekly mode, the code serializes the full task list and sends it to an external AI service automatically, without an explicit warning or consent step at the moment of transmission. Task data may contain internal project details, customer information, or other sensitive business context, making this an avoidable data disclosure risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The generated report is posted directly to a configured webhook endpoint, which is an external transmission of potentially sensitive operational data. Because the destination is fully configuration-driven and there is no validation, allowlist, timeout, or explicit safety warning, a misconfigured or malicious webhook can exfiltrate internal information to an attacker-controlled endpoint.

Content

Scanner excerpt · report_bot.py (reported line 109)May include surrounding context.

python
return False
        
        if platform == "feishu":
            response = requests.post(webhook, json={"msg_type": "text", "content": {"text": report}})
        elif platform == "dingtalk":
            response = requests.post(webhook, json={"msgtype": "text", "text": {"content": report}})
        else:

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This branch also transmits the full report to an externally configured webhook, creating the same data exfiltration risk as the Feishu branch. In this skill context, reports are likely to contain internal status, plans, blockers, or project details, so sending them to an untrusted or mistyped endpoint can leak sensitive business information.

Content

Scanner excerpt · report_bot.py (reported line 111)May include surrounding context.

python
if platform == "feishu":
            response = requests.post(webhook, json={"msg_type": "text", "content": {"text": report}})
        elif platform == "dingtalk":
            response = requests.post(webhook, json={"msgtype": "text", "text": {"content": report}})
        else:
            print(f"❌ 不支持的平台: {platform}")
            return False

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The argument help explicitly documents '报告类型：daily/weekly/monthly', but the generator only has branches for daily and weekly. This is not just incomplete documentation; it directly claims a supported mode that the code lacks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The file content is entirely in Chinese aside from product names and package commands, and it does not indicate that other languages are supported or that Chinese is an optional locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.