Scheduled Reports

Define, preview, approve, and manage recurring reports for OpenClaw. Use when the user asks for a scheduled report, daily or weekly report, automatic report,...

This skill appears to implement a legitimate scheduled-report workflow and includes a local Python validator, but there are a few things to clarify before installing: - Ask the publisher to confirm the correct file paths and packaging (SKILL.md references skills/scheduled-reports/scripts/..., but the included script is at scripts/validate_report_definition.py). This mismatch could break validation or indicate sloppy packaging. - Confirm where approved definitions, previews, and cron metadata will be written (exact config paths or storage service). The package metadata lists no required config paths, but the workflow clearly writes files — you should know the exact locations and access controls. - Ask what platform privileges are needed to create/modify OpenClaw cron jobs and to deliver artifacts (email/chat/webhook). If email or cron creation requires additional credentials, those should be declared and scoped narrowly. - Review the full validator script (already included) for network calls or unexpected behavior before running it in production. As provided the script looks like a local JSON/schema validator, but you should confirm the truncated portion contains no hidden network access or subprocess calls. - If you plan to test this skill, do so in a restricted environment (no access to sensitive production data) until you confirm the storage paths, cron behavior, and any required service credentials. If the author can confirm the path/config omissions are packaging errors and provide explicit storage/permission details, this package would be coherent; until then treat it as suspicious.

Type: OpenClaw Skill Name: scheduled-reports Version: 1.4.0 The scheduled-reports skill bundle is a well-architected tool for managing recurring reports with a strong emphasis on security and integrity. Key indicators of its benign nature include the implementation of integrity hashing for report definitions (lockedSubtreeSha256), strict validation of delivery targets to prevent SSRF and path traversal in scripts/validate_report_definition.py, and explicit instructions in SKILL.md to treat report data as untrusted to mitigate prompt injection. The skill enforces human-in-the-loop approval and uses environment fingerprinting to ensure runtime consistency.