AI Report Builder

AI Report Builder — Upload CSV/Excel, AI analyzes data and generates professional reports (charts + narrative). Supports monthly/financial/sales reports. Tri...

Security Scan

The skill mostly matches its stated purpose (build reports from CSV/Excel) but contains several inconsistencies and questionable behaviors (undeclared required env vars, a CLI/model mismatch, and billing behavior that transmits a user identifier and silently bypasses charging on errors) that should be clarified before use.

Purpose & Capability

The code implements CSV/Excel parsing, chart generation, AI analysis, and Excel report building — all consistent with the skill description. However, SKILL.md lists required billing environment variables (SKILL_BILLING_API_KEY, SKILL_BILLING_SKILL_ID, FEISHU_USER_ID) while the registry metadata at the top reported none; this mismatch is inconsistent and should be reconciled.

Instruction Scope

Runtime instructions are to run the included Python CLI. The generator reads FEISHU_USER_ID from the environment and sends it to the external billing endpoint (skillpay.me). The AI analysis step posts a prepared summary to an external LLM endpoint (api_base), which will transmit derived/summary data off-host. The SKILL.md states billing transmits FEISHU_USER_ID only for billing, but the code does perform external network calls (billing + LLM) and will send identifying info; users should expect that data leaves the host.

Install Mechanism

No external download/install spec is present; the skill is instruction/code-only and runs local Python code with standard dependencies listed in requirements.txt. No suspicious external install URLs or archive extraction are present.

Credentials

The only env-vars referenced are billing-related and a user identifier (FEISHU_USER_ID), which are proportionate to a pay-per-call billing model — but they were not declared in the registry metadata (inconsistency). Also note billing._is_dev_mode treats an empty SKILL_BILLING_API_KEY as dev mode and billing.charge_user returns success on exceptions, which effectively bypasses charging if the billing service is unreachable; that behavior is dangerous from a billing/integrity perspective and should be explicit.

Persistence & Privilege

The skill writes usage quota and chart images to /tmp (quota: /tmp/ai_report_builder/quota.json, charts: /tmp/auto_report_charts). This is limited local persistence and does not alter other skills or system-wide configuration. always is false, so it is not force-included.

What to consider before installing

Points to check before installing or running: - Confirm the required environment variables: SKILL_BILLING_API_KEY and SKILL_BILLING_SKILL_ID (billing) and FEISHU_USER_ID (user identifier) — these are present in SKILL.md and in the code but were not listed in the registry metadata. Ask the publisher to reconcile that discrepancy. - Understand data flows: the AI analysis sends a text summary of your data to the configured LLM endpoint (default: OpenAI). The billing module posts FEISHU_USER_ID to https://skillpay.me/api/v1/billing. If you are sensitive about any data (even summaries or identifiers) leaving your environment, do not run the AI step or block outbound network access. - Billing behavior: if SKILL_BILLING_API_KEY is empty the code treats the environment as dev mode (always allowed). Also, billing.charge_user catches exceptions and returns success on errors — this will silently bypass charging if the billing API is unreachable. If you rely on accurate billing enforcement, request that this behavior be changed or clarified. - CLI/model mismatch: the CLI accepts --ai-model, but the analyze_data() function does not accept or forward a model parameter from the CLI (it uses a hardcoded default internally). This means passing --ai-model may have no effect; confirm with the author if you care about which model is used. - Local persistence: quota is stored in /tmp/ai_report_builder/quota.json and charts in /tmp/auto_report_charts; these paths may be shared on multi-user hosts and are not encrypted. If this is a concern, run in an isolated environment. - Verify the billing service and domain (skillpay.me) independently and review its privacy/terms before providing billing keys or FEISHU_USER_ID. If you need a safer evaluation, ask the publisher for a signed provenance, a full threat model describing what is sent to the LLM and to the billing service, and a corrected manifest that lists required env vars in registry metadata.

Upload data (CSV/Excel) → AI analyzes → generates professional reports (charts + narrative + formatting).

---

Quick Start

python3 scripts/generator.py --input data.csv --output report.xlsx --template monthly_operation
python3 scripts/generator.py --input sales.xlsx --output monthly.xlsx --template sales

---

Tiered Features

Feature	FREE	PRO
Total uses	5 (lifetime)	Unlimited
Chart types	Line only	Line only
AI narrative analysis	—	Yes
Multi-sheet Excel	—	Yes
PDF export	—	—
Price	Free	$0.01/report

---

Core Features

• Multi-format support: CSV, Excel (.xlsx/.xls)
• AI-powered analysis: OpenAI-compatible API
• Chart generation: Line, bar, pie, scatter, histogram
• Multi-sheet Excel reports: Professional formatting
• Template system: Monthly, financial, sales, data comparison, custom

---

Usage

python3 scripts/generator.py \
  --input data.csv \
  --output report.xlsx \
  --template monthly_operation \
  --ai-provider openai \
  --ai-model gpt-4o-mini \
  --no-ai

Arguments:

• --input/-i: Data file path (CSV/Excel) — required
• --output/-o: Output report path (default: report.xlsx)
• --template/-t: Template type (monthly_operation/financial/sales/data_comparison/custom)
• --ai-provider: AI provider (openai/deepseek)
• --ai-model: AI model name
• --no-ai: Skip AI analysis (charts only)
• --sheet: Excel sheet name

---

Supported Templates

Template	Description
monthly_operation	Monthly operational report
financial	Financial analysis report
sales	Sales performance report
data_comparison	Period-over-period comparison
custom	Custom format

---

Directory Structure

ai-report-builder/
├── SKILL.md
├── requirements.txt
├── scripts/
│   ├── generator.py      # CLI entry point
│   └── __init__.py
└── core/
    ├── parser.py         # Data parsing (pandas)
    ├── charts.py         # Chart generation (matplotlib)
    ├── ai_analyzer.py    # AI analysis (OpenAI-compatible)
    ├── report_builder.py # Excel multi-sheet builder
    ├── quota.py          # Quota management
    └── templates.py      # Template system

---

Billing

• Pay-per-call: $0.0100 USDT per execution via SkillPay.me
• Balance insufficient: Payment URL returned — user tops up at https://skillpay.me/ai-report-builder
• External data flow: FEISHU_USER_ID transmitted to skillpay.me/api/v1/billing for billing identification only; not stored or shared with any third party
• Billing model: Each report generation = 1 call = $0.0100 USDT
• Privacy: FEISHU_USER_ID is used solely to identify the billing account; no personal data is retained or shared beyond the payment processor

---

Required Environment Variables

Variable	Description
SKILL_BILLING_API_KEY	SkillPay Builder API Key
SKILL_BILLING_SKILL_ID	SkillPay Skill ID (ai-report-builder)
FEISHU_USER_ID	User open_id for billing (passed by Feishu runtime)

---

License

MIT