← 返回 Skills 市场

Daily Report Joig

Name: Daily Report Joig
Author: joifg

作者 JoiFG · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

444

总下载

当前安装

版本数

在 OpenClaw 中安装

/install daily-report-joig

功能描述

生成简洁的中文日报（highlights/blockers/next），并可落盘为 Markdown 文件，适合个人复盘与同步。

使用说明 (SKILL.md)

Daily Report (joig)

Inputs

date（必填）：YYYY-MM-DD 或 YYYY/MM/DD
highlights（必填）：字符串数组，例如：["在 azure vm 上部署 openclaw","尝试写 skill"]
blockers（可选）：字符串数组
next（可选）：字符串数组（明日/下一步）
outputPath（可选）：默认 reports/{date}-daily-report.md

Output

返回固定结构：

status: ok|error
summary: 一句话总结
data: { date, outputPath }
nextAction: 建议的下一步

Behavior

规范化日期格式为 YYYY-MM-DD
生成 Markdown：

# 日报（{{date}}）

## Highlights
- ...

## Blockers
- ...

## Next
- ...

写入 outputPath（确保父目录存在）

Boundaries

不输出/复述任何 token、密钥、个人隐私。
不做绩效/压力话术；强调可执行与复盘。

安全使用建议

This skill is narrowly focused and internally consistent. Before using it: (1) test with a safe outputPath (e.g., a dedicated reports directory) to confirm where files are written; (2) avoid passing sensitive paths (system dirs, other users' data) or filenames that could cause path traversal; (3) run with an agent account that has limited filesystem permissions so the skill can only write to permitted locations; (4) if you plan to automate it, review produced Markdown content before sharing. No credentials or installs are required, so risks are limited to file writes.

功能分析

Type: OpenClaw Skill Name: daily-report-joig Version: 1.0.0 The skill is suspicious due to a critical arbitrary file write vulnerability identified in `SKILL.md`. The `outputPath` input parameter allows a user to specify an arbitrary file path, which the agent is instructed to write to without apparent sanitization or validation. This could lead to overwriting sensitive system files or user files (e.g., `../../../etc/passwd`), posing a significant risk of data corruption or potential privilege escalation if combined with other vulnerabilities. While the stated purpose is benign and the skill includes instructions against data leakage, this vulnerability is a serious security flaw.

能力评估

✓ Purpose & Capability

Name/description (generate short Chinese daily reports and optionally write to Markdown) aligns with the SKILL.md: it only normalizes a date, formats Markdown, and writes a file. No unrelated env vars, binaries, or installs are requested.

ℹ Instruction Scope

Instructions are narrowly scoped to normalizing the date, composing Markdown, and writing to outputPath (creating parent directory if missing). This is appropriate for the stated purpose, but writing to a user-specified filesystem path is the main operational effect to be aware of (ensure outputPath is safe and not e.g. a sensitive system path).

✓ Install Mechanism

No install spec and no code files — instruction-only skills present lower disk/execution risk.

✓ Credentials

No environment variables, secrets, or external credentials are requested; requested capabilities are proportionate to generating and saving a report.

✓ Persistence & Privilege

always is false and the skill does not request persistent/system-wide privileges or modify other skills; autonomous invocation is allowed (platform default) but not otherwise privileged.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install daily-report-joig
安装完成后，直接呼叫该 Skill 的名称或使用 /daily-report-joig 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release of daily-report-joig. - Generates concise Chinese daily reports in Markdown format (highlights/blockers/next). - Supports custom date format and output path. - Returns a structured response with status, summary, output path, and suggested next action. - Ensures privacy by not including tokens, secrets, or personal information. - Focuses on actionable and reviewable content for individual use.

元数据

Slug daily-report-joig

版本 1.0.0

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题