smart-charts
v2.0.1Intelligent chart generation and data analysis skill. Reads user-supplied data files (CSV/Excel/JSON), analyzes data characteristics with LLM assistance, aut...
⭐ 1· 140·1 current·1 all-time
byhanli@neuhanli
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the code and instructions: the repository contains parsers (CSV/Excel/JSON), a chart generator that emits ECharts options/HTML, a template manager, and format extractor. All requested capabilities are appropriate for an intelligent charting/reporting skill. The skill does not request unrelated credentials or system access.
Instruction Scope
SKILL.md stays within the stated purpose: it asks the agent to accept user-uploaded files, parse them, recommend/confirm merges, produce charts and reports, and scan a local templates/ directory for templates. This is expected, but it does mean the skill will read any files the user provides or places in the templates directory — users should avoid uploading sensitive credentials or secrets. The SKILL.md relies on the agent/LLM to choose chart types (no hidden or open-ended instructions that would grant broad data collection beyond user files).
Install Mechanism
There is no registry 'install' spec, but SKILL.md and requirements.txt instruct 'pip install -r requirements.txt'. The dependencies are standard (pandas, numpy, openpyxl; optional PyPDF2/python-docx). No downloads from untrusted URLs or archive extraction are present in the code. The minor mismatch (registry shows no install spec while the skill includes code + requirements and explicit pip guidance) is an operational inconsistency to be aware of.
Credentials
The skill declares no required environment variables, no primary credential, and no config paths. The code likewise does not read os.environ for secrets or reference unrelated credential/config files. The amount of access requested (read user-supplied files and read/write its own output/templates directories) is proportionate to the stated functionality.
Persistence & Privilege
The skill is not set to always: true and does not request elevated or persistent platform privileges. It writes outputs under configurable output_dir and templates_dir and manages a local template index; this file-writing is expected for a report-generation tool. It does not modify other skills' configurations.
Assessment
Plain-language considerations before installing/using this skill:
- Functionality: This skill parses files you upload and writes generated reports and templates into local directories (default ./smart_charts_output and ./templates). That is consistent with a chart/report generator.
- Installation: SKILL.md instructs 'pip install -r requirements.txt' (standard Python packages). Install in a virtual environment if you want to isolate dependencies.
- Data access: The skill will read any files you provide and any files placed in its templates directory. Do NOT upload or place files containing secrets, credentials, database connection strings, or personally identifying information you don't want processed.
- Code provenance: The registry metadata lacks a homepage and the source is 'unknown' with an opaque owner ID. If you require strong provenance, request or review the full source repository or contact the publisher before trusting sensitive data to the skill.
- Security posture: No network exfiltration code, subprocess shell-injection, or credential access was observed in the provided files. Still, if you plan to use it on sensitive data, review the code locally (the provided Python files are present and readable) or run it in a restricted environment.
When to be extra cautious: if you find any code modifications that add remote URLs, subprocess calls, or environment/OS-level credential reads, stop and re-evaluate. If you want, I can summarize specific files (data_parser.py, chart_generator.py, template_manager.py, format_extractor.py) line-by-line or search them for network, subprocess, or environment access patterns.Like a lobster shell, security has layers — review code before you run it.
latestvk9713g06n2ezvz7asb1s9reed983natd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
