数据分析技能包

数据分析技能包 - 自动抓取、清洗、可视化、生成报告。适合数据分析师、运营人员，告别 Excel 手工操作。

Security Scan

The skill's code mostly matches its stated purpose (fetch/clean/viz/report), but there are multiple packaging and instruction inconsistencies and a few operational risks (execSync usage, recommending tokens in config) that warrant caution before installing or running it.

Purpose & Capability

The declared purpose (data fetch, clean, visualize, report) matches the included scripts (data-fetch.js, data-clean.js, data-viz.js, report-generate.js). However the SKILL.md/README use inconsistent command names and paths (e.g., '/data-fetch', '/data-api', '/data-report' and references to 'data-report.js' or 'data-report'), while the code files include 'report-generate.js'. The SKILL.md file structure references package.json, install.bat, run.bat, config.json and example files, but those files are not present in the provided manifest — this mismatch suggests the package is incomplete or incorrectly packaged.

Instruction Scope

Runtime instructions tell users to 'npm install' and run commands, but the SKILL.md examples use non-existent or inconsistent command names (leading slash /data-fetch) and reference files that are missing. The README and config examples encourage putting Authorization Bearer tokens into config headers (config.json) — storing credentials in plaintext config files is insecure and is not declared as required env vars. The report generator (report-generate.js) requires child_process.execSync (present in code) which later likely runs external conversion tools (PDF/HTML/markdown converters) — executing external binaries based on config or input increases risk if the invoked commands or arguments are not strictly controlled.

Install Mechanism

There is no explicit install spec in the registry entry (no download/install script provided). SKILL.md instructs 'npm install', implying a package.json is required — but package.json is referenced in SKILL.md structure yet is not present in the file manifest. That mismatch prevents a straightforward install and suggests the published bundle is incomplete or incorrectly assembled.

Credentials

The skill declares no required environment variables, but its configuration examples and scripts accept Authorization headers and suggest placing tokens in config.json. Asking users to store API tokens in repository config files (not declared or protected) is disproportionate and risky. The scripts accept arbitrary --headers JSON and will use them in HTTP requests; combined with write-to-disk behavior this could expose secrets if mishandled. Also, execSync usage in report generation can cause environment-dependent side effects if external tools are invoked.

Persistence & Privilege

The skill does not request persistent always:true privileges and does not appear to modify other skills or system-wide agent settings. It writes outputs to a local 'output' directory within the skill and creates that directory if missing (normal). The main privilege concern is runtime: execSync may run system binaries during report generation, so run-time execution context matters — but autonomy flags are default/normal.

What to consider before installing

This package appears to implement the advertised data-analysis functions, but the bundle is inconsistent and incomplete — do not run it blindly. Before installing or executing: 1) Request the missing files (package.json, install/run scripts, config.json) or a corrected manifest; 2) Inspect package.json for postinstall scripts that run arbitrary code; 3) Review the full report-generate.js content to see exactly what execSync commands are executed (PDF/HTML converters or arbitrary shell calls); 4) Avoid placing API tokens in plain config files — prefer environment variables or a secure secrets store; 5) Run the code in an isolated sandbox/container and with non-sensitive test data first; 6) If you need to proceed on a production system, ask the author for a reproducible build (complete package.json) and a minimal reproducible example, and run npm audit and static analysis. If the author cannot provide missing files or explain the execSync usage, consider not installing this skill.

数据分析技能包 DataMaster Pro

一句话介绍

自动抓取数据、智能清洗、一键可视化、生成专业报告。

解决什么问题？

• 数据分散：多个来源手动复制粘贴 → 一键抓取聚合
• 清洗耗时：Excel 公式搞半天 → 自动识别并清洗
• 图表难看：不会做可视化 → 一键生成专业图表
• 报告难写：不会写分析 → AI 自动生成洞察

功能清单

• 🌐 数据抓取：网页爬取、API 对接、数据库连接
• 🧹 数据清洗：去重、补缺、格式化、异常检测
• 📊 可视化：折线图、柱状图、饼图、热力图、散点图
• 📝 报告生成：自动生成数据分析报告（Markdown/HTML/PDF）
• 🔄 定时任务：支持定时抓取和分析

快速开始

安装

# 进入技能包目录
cd data-analysis-skill
npm install

使用命令

# 网页数据抓取
/data-fetch <URL> --selector "table.data"

# API 数据获取
/data-api <API_URL> --method GET --output data.json

# 数据清洗
/data-clean data.json --rules clean-rules.json

# 生成可视化图表
/data-viz data.csv --type bar --title "销售趋势"

# 完整分析报告
/data-report data.csv --template business --output report.md

配置示例

{
  "sources": [
    {
      "type": "web",
      "url": "https://example.com/data",
      "selector": "table tbody tr",
      "schedule": "0 9 * * *"
    },
    {
      "type": "api",
      "url": "https://api.example.com/v1/data",
      "headers": {
        "Authorization": "Bearer TOKEN"
      }
    }
  ],
  "cleaning": {
    "removeDuplicates": true,
    "fillMissing": "mean",
    "normalizeColumns": ["price", "quantity"]
  },
  "visualization": {
    "defaultChartType": "bar",
    "colors": ["#4CAF50", "#2196F3", "#FF9800"],
    "width": 800,
    "height": 400
  }
}

文件结构

data-analysis-skill/
├── SKILL.md           # 技能定义（本文件）
├── README.md          # 产品说明
├── TUTORIAL.md        # 傻瓜式教程
├── install.bat        # 一键安装
├── run.bat            # 一键运行
├── config.json        # 配置示例
├── package.json       # 依赖管理
├── scripts/           # 核心代码
│   ├── data-fetch.js  # 数据抓取
│   ├── data-clean.js  # 数据清洗
│   ├── data-viz.js    # 可视化生成
│   └── data-report.js # 报告生成
├── templates/         # 报告模板
│   ├── business.md    # 商业报告模板
│   ├── technical.md   # 技术报告模板
│   └── weekly.md      # 周报模板
└── examples/          # 示例文件
    ├── sample-data.csv
    └── sample-report.md

核心脚本说明

data-fetch.js - 数据抓取

支持三种数据源：

• 网页抓取：CSS 选择器提取表格/列表数据
• API 请求：GET/POST 请求，支持认证
• 数据库：MySQL/PostgreSQL/MongoDB 连接

data-clean.js - 数据清洗

• 去重、去空值
• 格式标准化（日期、数字、文本）
• 异常值检测与处理
• 数据类型转换

data-viz.js - 可视化

• 自动推荐最佳图表类型
• 支持自定义样式
• 输出 SVG/PNG/HTML

data-report.js - 报告生成

• AI 驱动的数据洞察
• 多种模板可选
• 支持导出 Markdown/HTML/PDF

适用人群

• 数据分析师
• 运营人员
• 市场研究员
• 产品经理
• 财务人员

价格

• 基础版：¥99（网页抓取+基础清洗+5种图表）
• 进阶版：¥199（API对接+高级清洗+10种图表+报告模板）
• 专业版：¥299（数据库连接+AI洞察+定制模板+1对1指导）

---

开发者：AI-Company 联系：通过ClawHub