中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 20/100
Last scan:1 day ago Rescan
20 /100
Daily Report Skill
自动生成每日研究进展报告，并在指定时间推送给用户
A legitimate daily report generator with minor undeclared shell execution for status checking; no malicious indicators found.
Skill NameDaily Report Skill
Duration30.6s
Enginepi
✓
Safe to install
Document the execSync('openclaw status') call in SKILL.md and pin dependency versions for supply chain safety.

Findings 2 items

Severity Finding Location
Low
Undeclared shell execution for status check Doc Mismatch
SKILL.md documents filesystem operations but does not mention the execSync('openclaw status') call used to retrieve context usage percentage.
const output = execSync('openclaw status', { encoding: 'utf-8', stdio: 'pipe' });
→ Add a brief note in SKILL.md that the skill may invoke 'openclaw status' CLI for system status.
 generate.js:306
Info
Accesses agent session directory Sensitive Access
The skill reads session data from /root/.openclaw/agents/main/sessions/ which contains conversation history.
const SESSIONS_DIR = '/root/.openclaw/agents/main/sessions';
→ This is declared in SKILL.md as data source. No action needed.
 generate.js:40
ResourceDeclaredInferredStatusEvidence
Filesystem READ READ+WRITE ✓ Aligned generate.js:299 fs.writeFileSync for memory update
Shell NONE READ ✗ Violation generate.js:306 execSync('openclaw status')
Network NONE NONE — No network calls observed
Environment NONE NONE — No environment variable access
Skill Invoke NONE NONE — No cross-skill invocation
Clipboard NONE NONE — No clipboard access
Browser NONE NONE — No browser automation
Database NONE NONE — No database access

File Tree

4 files · 17.1 KB · 634 lines
JavaScript 1f · 516L Markdown 2f · 112L JSON 1f · 6L
├─ 🔑 config.json ⚠ JSON 6L · 89 B
├─ 📜 generate.js JavaScript 516L · 14.5 KB
├─ 📝 SKILL.md Markdown 87L · 2.2 KB
└─ 📝 template.md Markdown 25L · 343 B

Security Positives

✓ No network requests or data exfiltration observed
✓ No obfuscation (base64, eval) or anti-analysis techniques
✓ No credential harvesting or environment variable theft
✓ No reverse shell, C2, or remote code execution
✓ File operations are directly related to the stated report generation feature
✓ No malicious dependencies or supply chain risks
✓ Memory updates are append-only and localized to the feature scope