Morning Report

PassAudited by ClawScan on May 10, 2026.

Overview

This skill appears to do what it says—generate a web-sourced game industry morning report and send it to DingTalk—but users should verify the hardcoded DingTalk target and scheduled posting behavior.

This instruction-only skill is coherent and does not contain code, local file access, or credential handling. Before installing or scheduling it, verify that the DingTalk target ID is yours or your team’s, and ensure you are comfortable with automatic daily posting.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

The generated report will be posted to the specified DingTalk target, so the user should make sure that target is the intended group or channel.

Why it was flagged

The skill explicitly sends the completed report to an external DingTalk channel target. This is disclosed and purpose-aligned, but it is still an outbound data flow to a specific destination.

Skill content

tool: message
action: send
channel: dingtalk
target: 2735046220840628
message: <完整的晨报Markdown内容>

Recommendation

Confirm the DingTalk target ID before use, especially if installing the skill outside the original team environment.

Low

#ASI03: Identity and Privilege Abuse

What this means

If the message tool is authorized for DingTalk, the skill can post reports using that authorization.

Why it was flagged

Sending through DingTalk uses whatever posting authority is available to the message tool. No credentials are embedded in the artifacts, and the behavior matches the stated push-report purpose, but it does rely on delegated messaging permission.

Skill content

必须显式调用 message 工具把内容发到钉钉，发送成功后再结束任务。

Recommendation

Use a DingTalk bot or account with only the channel-posting permission needed for this report.

Info

#ASI10: Rogue Agents

What this means

If an external scheduler is configured, the skill may run and post every morning without a fresh manual prompt.

Why it was flagged

The skill describes recurring automatic execution. The provided artifacts do not create a cron job, so this is disclosed intended runtime behavior rather than hidden persistence.

Skill content

由 cron job 在每天早上 7:30（CST）自动触发，通过 `run morning-report` 命令调用

Recommendation

Only connect it to a scheduler if daily automatic posting is intended, and keep the scheduler easy to disable.