ClawHub

Chart Generator Pro

v1.0.2

Use this skill when the user wants to create visualizations (charts, dashboards, diagrams, Gantt, PPT), analyze data (Excel/CSV upload, cross-file analysis,...

⭐ 0· 69·0 current·0 all-time
byChartGen AI@chartgen-ai
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name and description (visualizations, CSV/Excel uploads, reports/PPT) match the included helper tool and the single required credential (CHARTGEN_API_KEY). The tool uploads files and posts queries to chartgen.ai endpoints, which is coherent with the stated purpose.
ℹ
Instruction Scope
SKILL.md tightly constrains behavior (explicit confirmation flow, verbatim user query submission, explicit file validation and upload). It instructs the agent to read local file paths (user-provided files) and to call the included node script. This is appropriate for the feature set, but the skill does read common local key files (see environment_proportionality) and requires the agent to run a local Node.js script—users must be comfortable allowing file uploads to the ChartGen API.
✓
Install Mechanism
No install spec (instruction-only skill) and the helper script contains no external download or package installation. The tool uses only Node.js built-ins. Lowest-risk install posture.
ℹ
Credentials
Primary credential CHARTGEN_API_KEY is appropriate. The helper code will also read environment variables (CHARTGEN_API_URL, OPENCLAW_STATE_DIR) and look for API keys in a small set of local config paths (~/.openclaw, ~/.config/chartgen/api_key, ~/.chartgen/api_key). This behavior is reasonable to find a user-provided key, but users should be aware the tool will try to read those files if CHARTGEN_API_KEY is not explicitly set. Allowing CHARTGEN_API_URL to be overridden could be abused if the environment is maliciously configured.
✓
Persistence & Privilege
always:false and no evidence of the skill trying to modify other skills or global agent settings. It creates or uses media/workspace directories under OpenClaw state or user home and writes artifact files there, which is expected for saving generated images/PPTs.
Assessment
This skill appears to do what it claims: it uploads user CSV/Excel files and posts queries to ChartGen's API using CHARTGEN_API_KEY. Before installing: 1) Be prepared to run Node.js (SKILL.md requires node >=14) — the registry metadata didn't list a required binary, so ensure Node is available. 2) Provide a CHARTGEN_API_KEY (or expect the helper to search for keys in ~/.openclaw, ~/.config/chartgen/api_key, or ~/.chartgen/api_key). If you don't want the helper to scan those files, set CHARTGEN_API_KEY explicitly in the environment. 3) Only upload data you consent to send to chartgen.ai; generated artifacts and uploads are sent to the service (BASE_URL defaults to https://chartgen.ai but can be overridden by CHARTGEN_API_URL in the environment—do not change that to an untrusted endpoint). 4) The skill requires explicit user confirmation before submitting; verify the exact text being submitted if you have privacy concerns. If you trust ChartGen (or the GitHub/homepage source) and can run Node.js, the skill is coherent with its stated purpose.

Like a lobster shell, security has layers — review code before you run it.

latestvk975a9rj4m5v7v0mb3btk5vxe183pg22

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Primary envCHARTGEN_API_KEY

Comments