Security audit

OpenClaw Daily Briefing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward morning briefing helper, with expected privacy considerations around weather, calendar, tasks, and news data.

Install this only if you want a morning briefing that may use weather, calendar, todo, and news context. Before enabling the scheduled run or Enterprise WeChat dependencies, review what those dependent skills can access, and be aware that the included weather helper contacts wttr.in unless replaced or disabled.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill aggregates calendar, to-do, location/weather, and external news data but does not warn users that it accesses personal scheduling/task information and third-party sources. This can lead to uninformed consent, overbroad deployment, and accidental disclosure of sensitive personal or work information in generated briefings.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: The script makes an outbound request to wttr.in without informing the user that execution will contact a third-party service and disclose metadata such as IP address, timing, user agent, and possibly environment-dependent network details. This is not remote code execution, but it is a real privacy/security concern because the skill silently transmits data off-device during a routine local briefing workflow.

Static analysis

No suspicious patterns detected.