Daily Learning Summary

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:43 AM UTC
• Version: 1.0.0

Overview

This is a local daily-summary skill that openly reads workspace activity files and writes a daily learning report, with some persistence and formatting caveats.

Install only if you want this skill to create persistent daily learning summaries in your workspace. Treat the generated Markdown as report data, not trusted instructions, especially if other tools can write to the source memory files. Review the Chinese-only output and the same-day overwrite behavior before enabling heartbeat automation.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: scripts/daily_learning_summary.py:81

Finding

Unsanitized External Data Is Persisted into Agent Learning Memory

Content

View full analysis

= 3: skill_name = parts[1].strip() rating = parts[2].strip() discoveries.append(f"{skill_name} ({rating})") summary["clawhub"]["discoveries"] = discoveries[:5] ``` Values from the heartbeat state are also accepted without type or content validation: ```python state = read_heartbeat_state() stats = state.get("stats", {}) summary["instreet"]["comments"] = stats.get("instreet_interactions_today", summary["instreet"]["comments"]) summary["clawhub"]["earned"] = stats.get("clawhub_虾米_earned_today", 0) ``` The imported values are interpolated directly into the Markdown report: ```python if summary["clawhub"]["discoveries"]: lines.extend([f" - {d}" for d in summary["clawhub"]["discoveries"]]) else: lines.append(" - 暂无记录") lines.extend([ f"- 虾米变动: +{summary['clawhub']['earned']} (收入) / -{summary['clawhub']['cost']} (支出)", ``` The resulting report is then persisted in the Agent's learning-memory directory: ```python log_file = LEARNING_DIR / f"{summary['date']}.md" with open(log_file, 'w', encoding='utf-8') as f: f.write(report) ``` ### Technical Analysis The script transfers values from `memory/clawhub_discoveries.md` and `memory/heartbeat-state.json` into `memory/learning/YYYY-MM-DD.md` without enforcing expected data types, length limits, character allowlists, Markdown escaping, or trust-boundary annotations. A malicious or compromised data producer can place instruction-like natural-language content in a skill-name, rating, interaction-coun ...[truncated 2149 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly states it writes daily summaries to persistent memory files, but the description section does not clearly warn users up front that execution will modify long-lived workspace state. In an agent setting, undocumented automatic writes can cause unintended data retention, overwrite assumptions, and privacy/governance issues because users or downstream agents may treat the skill as read-only automation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The output example and naming indicate the skill produces Chinese-language summaries without presenting language selection or consent. While not a direct code-execution risk, forced language output can reduce operator visibility, cause misunderstandings in audit or review workflows, and make automated downstream processing fail if systems expect another language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s title, docstrings, and generated report content are written exclusively in Chinese, and the report generator hardcodes Chinese output strings throughout the script. This creates a natural-language locale constraint without any opt-in, alternative language path, or justification that the skill is intended only for a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code contains multiple user-facing strings in Chinese, including the module docstring and printed status/error messages, and it does not provide an opt-in or alternative locale. That can violate a language-policy requirement because the skill effectively forces a specific language for interaction and diagnostics.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/validate.py (reported line 25)May include surrounding context.

python

def run_script():
    print("🧪 测试脚本执行...")
    result = subprocess.run([sys.executable, str(SCRIPT)], capture_output=True, text=True, cwd=str(SKILL_ROOT.parent))
    print(result.stdout)
    if result.returncode != 0:
        print(f"❌ 脚本执行失败: {result.stderr}")

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script asserts that only standard-library dependencies are required, but later relies on the external date executable. This mismatch can cause validation to pass the dependency phase while still failing or behaving unexpectedly on systems where date is unavailable, aliased, or manipulated via PATH, making the validation result unreliable.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/validate.py (reported line 39)May include surrounding context.

python

missing = []
    for dep in deps:
        try:
            __import__(dep)
        except ImportError:
            missing.append(dep)
    if missing:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/validate.py (reported line 50)May include surrounding context.

python

def check_output():
    print("📊 检查输出...")
    today = subprocess.check_output(["date", "+%Y-%m-%d"]).decode().strip()
    log_file = LEARNING_DIR / f"{today}.md"
    if not log_file.exists():
        print(f"❌ 今日日志不存在: {log_file}")

Static analysis

No suspicious patterns detected.