ClawHub

Aloudata CAN SKILLS - metric-attribution

v1.0.4

对指标波动进行综合归因诊断，定位导致指标变化的关键因子、维度和外部事件。当用户需要分析指标波动原因、定位指标变化的根因、做因子拆解归因（如 GMV = UV × 转化率 × 客单价）、或理解指标为什么涨跌时，必须使用此 Skill。 触发场景包括但不限于：用户提到"归因""归因分析""波动分析""波动归因""根因...

⭐ 2· 541·2 current·2 all-time
by@jackyujun
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (metric attribution) match the declared network calls and the single required env var (CAN_API_KEY). The domain whitelist (gateway.can.aloudata.com) and the API-key header usage are coherent with the stated functionality.
ℹ
Instruction Scope
SKILL.md narrowly instructs the agent to call the Gateway API and run local calculations; it explicitly requires looking up metric/dimension metadata before querying. One minor note: the doc mentions '结合外部事件检索' (combine external event retrieval) but does not enumerate external endpoints — platform domain whitelist only lists the Gateway host, so either external-event lookups are expected to be manual/knowledge-based or additional endpoints would be needed. Otherwise the instructions do not ask the agent to read unrelated secrets or system files beyond the expected ~/.openclaw/.env for CAN_API_KEY.
✓
Install Mechanism
Instruction-only skill with no install spec or code files, so nothing is written to disk or downloaded during install.
✓
Credentials
Only one required environment variable (CAN_API_KEY) is declared and is appropriate for authenticating to the Gateway API. The skill does not request unrelated credentials or config paths.
✓
Persistence & Privilege
always is false and the skill does not request elevated or persistent system privileges. Autonomous invocation is allowed (platform default) but is not combined with other concerning flags.
Assessment
This skill appears internally consistent: it will read a single API key (CAN_API_KEY) from your environment and make network requests to gateway.can.aloudata.com to fetch metric metadata and data for attribution analysis. Before installing, confirm you are comfortable storing the API key in ~/.openclaw/.env and that the key's permissions are appropriately scoped (least privilege). If you expect the skill to correlate external events (news, holidays, competitor data), ask how those external sources will be queried — the skill's domain whitelist only includes the Gateway host, so additional endpoints would need explicit allowance. Finally, review any metric query results for sensitive data exposure and rotate the API key if you stop using the skill.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fa41p840aqzvcepgankarh5834tbg

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments