日报生成技能 - 自动收集数据并生成工作日报

This skill is coherent with its stated purpose, but check these before installing: - openclaw CLI: the send functions call `openclaw message send` to deliver report text. Verify what your local `openclaw` CLI does and where it will send messages (to avoid accidental data leaks). - Default targets: the code contains default WEIXIN_ACCOUNT and WEIXIN_USER_ID values. If you don't set your own WEIXIN_* env vars, reports could be sent to those defaults if you run send operations. Override or remove them before sending. - Cron/autonomy: install.sh can add a cron job to run automatically — only add it if you want daily automated runs. Note the auto-run path currently calls the collect script which prompts for manual input; in practice the auto-run may block or behave oddly unless you edit the scripts to run fully non-interactively. - Sensitive content: reports include calendar, todo, and email summaries (even example data). If you later integrate real calendars or email, be mindful that report content could include sensitive information and will be transmitted by the send commands. - Test in a sandbox: run the included tests (npm test / ./tests/test-daily-report.sh) and inspect the code locally. If you plan to enable automatic sending, test with a safe target account first. If you want, I can highlight exact lines where the send command is built, or suggest minimal code changes to make automated cron runs non-interactive and safer (e.g., add an AUTO_MODE check to skip manual prompts and require an explicit --send flag for transmissions).

Type: OpenClaw Skill Name: daily-report-cn Version: 1.0.0 The skill contains hardcoded WeChat recipient IDs and account credentials (e.g., WEIXIN_USER_ID '[email protected]') in scripts/generate-report.js and scripts/send-report.js, which could lead to sensitive work data being sent to an external party if not manually reconfigured. Additionally, scripts/collect-data.js executes a misleading osascript command to list all running system processes on macOS while claiming to collect calendar data. While these behaviors might be intended as placeholders, the combination of hardcoded exfiltration targets and unnecessary process enumeration is high-risk.