YTLong Daily Report

Automatically generate daily/weekly work reports from git commits, calendar events, and task lists. Use when you need to quickly create professional work rep...

The skill claims it aggregates git, calendar, and tasks, but the code only reads git commits — treat calendar/task features as unimplemented. Before installing or running: (1) review .reportrc.json and only include trusted local repo paths — untrusted paths can lead to shell injection because the code embeds repo strings into a shell command; (2) prefer to run the script in a non-sensitive directory and inspect the generated report file; (3) if you need calendar/task integration, request clarification or an updated version that implements and documents secure OAuth handling; (4) consider patching the code to avoid execSync string interpolation (use child_process.spawn with argument arrays or validate/sanitize repo paths) to eliminate command-injection risk.

Type: OpenClaw Skill Name: ytlong-daily-report Version: 1.0.0 The skill contains a shell injection vulnerability in index.js within the getGitLogs function, where repository paths from the .reportrc.json configuration file are interpolated directly into a shell command via execSync. While the code appears to serve its stated purpose of generating git-based reports, the lack of input sanitization on the 'repo' variable allows for arbitrary command execution. Additionally, SKILL.md claims features like calendar and task integration that are entirely absent from the provided implementation.