BP Reporting Templates

Generate BP monthly/quarterly/half-year/year report filling templates from BP data (API first, file fallback) with strict reviewer checks for code anchors, n...

Security Scan

The skill's code, instructions, and required secrets align with its stated purpose (filling BP report templates from a BP API), with only minor packaging/documentation inconsistencies to review before use.

Purpose & Capability

Name/description match the code: the package fetches BP data from a company BP API and fills report templates. The network endpoints (base_url) and API calls in scripts/api_client.py are consistent with a BP backend. One inconsistency: registry metadata at the top of the report lists no required env vars, but SKILL.md and the code expect an app key (BP_APP_KEY or COMPANY_APP_KEY).

Instruction Scope

SKILL.md instructs running scripts/main.py, selecting a period and template types, and providing an app key via env/arg. The runtime rules limit behavior to fetching BP data, filling templates, reviewing them, and writing outputs. The instructions do not ask the agent to read unrelated system files or exfiltrate data to unexpected endpoints. The code uses a fallback env (BP_PERIOD_OPTIONS_JSON) and local template/reference files.

Install Mechanism

There is no install spec (no remote downloads). All Python source files are bundled and require normal Python deps (requirements.txt). This is lower-risk than installing remote binaries, but the package will execute Python code locally and perform outbound HTTP requests — review requirements.txt and run in a controlled environment if needed.

Credentials

The skill legitimately needs an API app key (BP_APP_KEY or COMPANY_APP_KEY) to call the BP backend; it also may read BP_PERIOD_OPTIONS_JSON as a fallback. No unrelated secrets or multiple external credentials are requested. The earlier registry summary omitted BP_APP_KEY which is a packaging/documentation mismatch to address.

Persistence & Privilege

The skill does not request always:true or any elevated persistent privileges. It runs on demand, writes output files to a configurable output directory, and does not modify other skills or global agent config.

Assessment

This skill appears to do what it says: call your internal BP API with an app key, parse the returned BP data, fill report templates, and run a reviewer pass before writing Markdown output. Before installing/use: 1) Confirm the app key (BP_APP_KEY/COMPANY_APP_KEY) is scoped appropriately — the key will be sent to the configured base_url (https://sg-al-cwork-web.mediportal.com.cn/open-api) so ensure you trust that endpoint. 2) The package contains runnable Python code (requirements.txt); review dependencies and run in an isolated environment if possible. 3) There's a packaging/documentation mismatch: the registry shows no required env vars but SKILL.md/code require BP_APP_KEY — fix or verify metadata. 4) If you need higher assurance, inspect the bundled scripts (api_client.py, reviewer.py) for any additional endpoints or logging of sensitive fields, and test with a non-production app key. Finally, note minor implementation bugs (e.g., a CLI variable typo) that may affect functionality but not security; ask the maintainer to correct packaging and CLI errors before widespread use.

Mandatory pre-check (before generation)

When this skill is used, always do two selections first:

1. List and select BP period
2. List and select template types (月报/季报/半年报/年报/四套)

Do not generate until both are confirmed.

Script entry

• scripts/main.py

Useful commands

# 1) 列出可选周期（供用户选择）
python3 scripts/main.py --list-periods --app-key "$BP_APP_KEY"

# 2) 列出可选生成类型（供用户选择）
python3 scripts/main.py --list-template-types

# 3) 执行生成（示例：季报+年报）
python3 scripts/main.py "为产品中心生成" \
  --app-key "$BP_APP_KEY" \
  --period-id "<period_id>" \
  --template-types "季报,年报" \
  --output ./output

# 4) 输入中未识别组织时可显式指定
python3 scripts/main.py "生成季报" \
  --app-key "$BP_APP_KEY" \
  --period-id "<period_id>" \
  --org-name "产品中心" \
  --template-types "季报"

Runtime rules

• app_key must come from env/arg (BP_APP_KEY or COMPANY_APP_KEY), not hardcoded in code.
• Team default: use the validated standard company key via env injection (prefer BP_APP_KEY).
• If period is missing and multiple periods exist, ask user to choose.
• If template types are missing, ask user to choose.
• Keep output markdown traceable to BP source content.