ClawHub

Chart Generator

v1.0.2

Use this skill when the user wants to create visualizations (charts, dashboards, diagrams, Gantt, PPT), analyze data (Excel/CSV upload, cross-file analysis,...

⭐ 0· 99·0 current·0 all-time
byChartGen AI@chartgen-ai·duplicate of @chartgen-ai/chartai
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (visualizations, file analysis, reports) match the included helper script which uploads data, posts queries, polls tasks, and returns artifacts. Requiring an API key for an external ChartGen service is appropriate.
ℹ
Instruction Scope
The SKILL.md mandates sending the user's exact text verbatim and allows uploading user-selected files (absolute paths). This is coherent for analysis/visualization but means any secrets or sensitive content in the user's message or uploaded files will be sent to the external service. The instructions also require copying the confirmed text exactly, and instruct background polling behavior — all consistent with the stated purpose.
✓
Install Mechanism
No install spec; the skill is instruction + a single Node.js helper script that uses only built-in modules. No downloads from untrusted URLs or package installs are present.
ℹ
Credentials
Primary credential CHARTGEN_API_KEY is appropriate. The tool also reads CHARTGEN_API_URL, OPENCLAW_STATE_DIR, and several well-known config paths (e.g., ~/.config/chartgen/api_key, ~/.chartgen/api_key, ~/.openclaw/skills/chartgen/config.json) to locate an API key; CHARTGEN_API_URL is used to override the API host but is not declared in the skill metadata. Reading those specific config files is reasonable for convenience but means the tool will attempt to access files in the user home or OpenClaw state directory to find an API key.
✓
Persistence & Privilege
Skill does not request always:true, does not modify other skills, and only writes artifacts/media to OpenClaw state or home media/workspace directories. Autonomous invocation is default and not sufficient alone to raise a concern.
Assessment
This skill will send the exact text you confirm and any files you choose to the ChartGen service (default https://chartgen.ai). Before using it: (1) avoid submitting sensitive secrets or private files because they will be uploaded; (2) provide only the minimal data needed for the chart/report; (3) store your API key in a dedicated credential (CHARTGEN_API_KEY) rather than leaving unrelated tokens in the scanned config files; and (4) be aware the helper respects CHARTGEN_API_URL (if set) so verify that env var is not pointed to an untrusted host. If you are uncomfortable with automatic uploads or verbatim forwarding of user text, do not install or restrict the skill's usage to non-sensitive tasks.

Like a lobster shell, security has layers — review code before you run it.

latestvk97cn5dtpwn1fdf788cxc4c28h83pa61

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Primary envCHARTGEN_API_KEY

Comments