Aloudata CAN SKILLS - scheduled-report

将当前对话中已完成的分析流程，提取并固化为定时执行的任务（周报/月报/日巡检等）。本 Skill 是一个纯粹的**编排层**——它不负责定义"怎么分析"，只负责"把你刚才做的分析录下来，变成能定时重放的任务"。 触发场景包括但不限于：用户提到"定时报告""定时分析""定期执行""自动报告""把这个分析变成周报""...

This skill is conceptually what it says (it records a performed analysis and turns it into a scheduled task), but there are several things to check before installing: 1. Confirm runtime tooling and permissions: SKILL.md uses the openclaw CLI (openclaw cron add) and expects metric-query/Gateway capabilities. Verify that your environment provides these tools and that the skill's metadata should have declared them. If your environment lacks openclaw, the instructions will fail. 2. Watch for data persistence: The skill embeds conversation-derived parameters, filters, and possibly analysis outputs into the scheduled prompt. Those stored prompts will persist and run later — they can contain PII or sensitive identifiers. Ask whether scheduled task storage is encrypted, who can view/edit tasks, and whether prompts are logged or visible to admins. 3. Redaction and least privilege: Before creating schedules, insist the agent (or you) review and redact any sensitive fields (user IDs, API keys, secrets, personal data). The skill does not describe any automatic redaction. 4. Inconsistencies to clarify: The doc both prohibits direct Gateway API calls (delegating to metric-query) and elsewhere says it will search the Gateway. Ask the author which is intended and ensure the orchestration only calls approved analysis skills rather than raw APIs. 5. Test with non-sensitive data: Try creating a sample scheduled task using dummy or low-risk queries first to confirm behavior (where reports are saved, who can trigger/stop tasks, how outputs are stored). If these concerns are addressed (declare openclaw dependency, confirm storage/access controls, and add redaction guidance), the skill is more acceptable. Without that, it’s unsafe to assume the skill will not persist sensitive conversation content or attempt operations the environment isn't prepared for.

Type: OpenClaw Skill Name: scheduled-report Version: 1.0.0 The 'scheduled-report' skill is an orchestration tool that automates data analysis by converting conversation history into scheduled tasks via the 'openclaw cron' CLI. While its behavior is aligned with its stated purpose, it is classified as suspicious due to a potential shell injection vulnerability in SKILL.md (Step 5.3). The instructions suggest writing a prompt to a temporary file and then executing a shell command using '$(cat /tmp/task_prompt.txt)', which could lead to arbitrary command execution if the prompt content (derived from user-influenced conversation history) is not properly sanitized.