Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Data Reporter
v1.0.0Automated data reporting and dashboard generation. Connect to databases, APIs, spreadsheets. Generate PDF/PPT/Excel reports with charts. Schedule daily/weekl...
⭐ 0· 102·0 current·0 all-time
byFuhaolin@fuczy
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md clearly implements a data-reporting/dashboard tool (databases, APIs, cloud storage, email/Slack outputs) which is coherent with the name/description. However the registry metadata does not declare any required environment variables or config paths even though the instructions require API keys, service-account JSON files, and access to local/cloud storage — this is an inconsistency.
Instruction Scope
Runtime instructions explicitly direct access to local files, credential files (e.g., ga-credentials.json), SFTP/FTP, S3/GCS/Azure blobs, and many third-party APIs and delivery channels (email/Slack/Teams). That scope is expected for reporting, but the SKILL.md also shows CLI commands using 'clawhub' while the metadata's required binaries list does not include 'clawhub' — a concrete mismatch. The instructions also assume the agent will read and write files and send data externally, so ensure only intended credentials/data are made available.
Install Mechanism
This is an instruction-only skill with no install spec or code files, so it does not pull external archives or install packages. That minimizes installation risk.
Credentials
The skill will need many credentials in practice (API keys, OAuth/service-account files, database connection strings), but requires.env and primary credential fields are empty in the registry metadata. The absence of declared env vars/config paths is disproportionate to the described functionality and reduces transparency about what secrets will be needed or used.
Persistence & Privilege
always=false and the skill is user-invocable; it does not request permanent platform-wide privileges. Note: agent autonomous invocation is permitted by default (disable-model-invocation=false) — combined with broad access to external data sources this increases blast radius if credentials are provided, but this is a platform default rather than a property unique to this skill.
What to consider before installing
This skill appears to do what it claims (connect to many data sources and produce reports) but the package metadata omits expected details: it declares no required environment variables or config paths even though the SKILL.md shows you must supply API keys, service-account JSON files, DB connection strings, and local file access. Also the examples call 'clawhub' but the metadata's required binaries list doesn't include 'clawhub'. Before installing or enabling this skill: 1) Confirm where and how you will supply credentials (avoid pasting admin/long-lived keys; use least-privilege service accounts and read-only keys). 2) Ensure the 'clawhub' CLI is available or ask the publisher to correct the metadata. 3) Test with limited, non-sensitive sample data and isolated environment (sandbox or VM). 4) Prefer storing credentials in protected locations and restrict the skill's access to only needed buckets/databases. 5) If you cannot verify the publisher or need clearer credential requirements, treat this as higher risk and request an updated manifest that declares required env vars/config paths and explains how secrets are used.Like a lobster shell, security has layers — review code before you run it.
latestvk9762tsk7086ztd49xzw2qkv75832k8h
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📊 Clawdis
Binsopenclaw, curl, jq