Daily Business Report

Generate daily business briefings from multiple data sources. Aggregates weather, crypto prices, news headlines, system health, and calendar events into a fo...

This skill appears to do what it says, but review these practical points before installing: - Network calls: The script performs outbound HTTP(S) requests to public APIs (wttr.in, api.coingecko.com, api.quotable.io, and optionally newsdata.io). If you operate in a restricted environment, confirm these endpoints are allowed. - Local storage: It creates and reads a config file at ~/.daily-report/config.json (or the directory set by REPORT_CONFIG_DIR). If you store a NewsData.io API key there, it will be saved in plain JSON; consider file permissions and whether you want credentials stored on disk. - System info: The script reads disk usage and /proc/meminfo to report system health. That exposes basic resource usage which could be sensitive if reports are forwarded externally. - Delivery/cron: The SKILL.md/README show examples of scheduling and say 'send the result' — the bundled code does not itself send reports to messaging services. If you wire this into a cron/job that forwards output (e.g., email, chat, webhook), review and secure the delivery target to avoid leaking internal data. - Test locally first: Run the provided test commands and inspect the generated output and the config file before enabling automation. If you need encrypted or centrally managed API keys, avoid placing them in the plain config JSON and instead use a secrets manager or environment with restricted access. If you want, I can scan the remainder of the script (the truncated part) for any unexpected behavior or help draft a safe deployment checklist.

Type: OpenClaw Skill Name: oc-daily-business-report Version: 1.0.0 The skill's `scripts/report.py` file contains a Server-Side Request Forgery (SSRF) vulnerability. User-controlled inputs (e.g., `city`, `crypto` IDs, `news_country`) are directly concatenated into API URLs without robust sanitization. This could allow an attacker, via prompt injection against the OpenClaw agent, to force the script to make requests to arbitrary internal or external hosts, potentially leading to information disclosure or interaction with internal services. While this is a significant vulnerability, there is no clear evidence of intentional malicious behavior such as data exfiltration, persistence, or unauthorized remote control.