Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

officecli-data-dashboard

v1.0.2

Use this skill when the user wants to create a data dashboard, analytics dashboard, KPI dashboard, or executive summary from CSV/tabular data in Excel format...

0· 110·1 current·1 all-time
by瓦砾@iceyliu

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for iceyliu/officecli-data-dashboard.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "officecli-data-dashboard" (iceyliu/officecli-data-dashboard) from ClawHub.
Skill page: https://clawhub.ai/iceyliu/officecli-data-dashboard
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install officecli-data-dashboard

ClawHub CLI

Package manager switcher

npx clawhub@latest install officecli-data-dashboard
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name, description, and runtime commands all align: it builds a single .xlsx dashboard from CSV input using a CLI called officecli. Requesting a CLI to perform Excel operations is reasonable. However, the SKILL.md implicitly requires officecli to be present but the skill does not declare that requirement in metadata (no install spec) — the installer is only invoked via the instructions.
!
Instruction Scope
The SKILL.md instructs the agent to run local shell commands (officecli create/import/set/batch) which is expected for this purpose. The concerning part: the 'BEFORE YOU START' block instructs the agent to run curl to download an install.sh from raw.githubusercontent.com and immediately bash it (and to query the GitHub API). That directs network-download-and-execute behavior at runtime and gives the skill the ability to run arbitrary code on the host when invoked.
!
Install Mechanism
There is no formal install spec in the registry metadata, but the instructions embed a download-and-execute pattern (curl -fsSL https://raw.githubusercontent.com/.../install.sh && bash /tmp/officecli_install.sh). While GitHub raw is a common host, executing an unverified remote script without pinned versions, checksums, or signatures is higher-risk per the install-mechanism guidance.
Credentials
The skill does not request environment variables, credentials, or config paths. All commands operate on local files (CSV, .xlsx). There are no requests for unrelated secrets or cross-service credentials in the metadata or instructions.
Persistence & Privilege
The skill is not 'always: true' and does not request persistent system-wide privileges in metadata. The instructions do install a CLI when run, which will add binaries to the system, but the skill does not claim or request persistent elevated privileges or modify other skills' configs.
What to consider before installing
This skill appears to do what it says (build Excel dashboards), however the runbook tells the agent to download and execute an installer script from raw.githubusercontent.com every time officecli is missing or out-of-date. Before installing or running this skill: 1) Inspect the installer script (https://raw.githubusercontent.com/iOfficeAI/OfficeCli/main/install.sh) yourself — do not blindly run curl | bash. 2) Prefer a pinned release or checksum verification (the current check compares versions via the GitHub API but does not verify installer integrity). 3) If you cannot audit the installer, pre-install officecli manually from a trusted source or run the skill in a sandboxed environment. 4) Confirm the GitHub repository and publisher identity (iOfficeAI) and check for community reputation. These steps reduce the risk of executing unexpected code on your machine.

Like a lobster shell, security has layers — review code before you run it.

latestvk971xnssp1yvk2nf3b6ah4bzzx840rq5
110downloads
0stars
3versions
Updated 3w ago
v1.0.2
MIT-0

Data Dashboard Skill

Create professional, formula-driven Excel dashboards from CSV or tabular data. The output is a single .xlsx file with a data sheet and a Dashboard sheet -- charts linked to live data, KPIs powered by formulas, and conditional formatting for visual insight.


BEFORE YOU START (CRITICAL)

Every time before using officecli, run this check:

if ! command -v officecli &> /dev/null; then
    echo "Installing officecli..."
    curl -fsSL https://raw.githubusercontent.com/iOfficeAI/OfficeCli/main/install.sh -o /tmp/officecli_install.sh && bash /tmp/officecli_install.sh && rm -f /tmp/officecli_install.sh
    # Windows: irm https://raw.githubusercontent.com/iOfficeAI/OfficeCli/main/install.ps1 -OutFile "$env:TEMP\officecli_install.ps1"; & "$env:TEMP\officecli_install.ps1"
else
    CURRENT=$(officecli --version 2>&1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
    LATEST=$(curl -fsSL https://api.github.com/repos/iOfficeAI/OfficeCLI/releases/latest | grep '"tag_name"' | sed -E 's/.*"v?([0-9.]+)".*/\1/')
    if [ "$CURRENT" != "$LATEST" ]; then
        echo "Upgrading officecli $CURRENT -> $LATEST..."
        curl -fsSL https://raw.githubusercontent.com/iOfficeAI/OfficeCli/main/install.sh -o /tmp/officecli_install.sh && bash /tmp/officecli_install.sh && rm -f /tmp/officecli_install.sh
    else
        echo "officecli $CURRENT is up to date"
    fi
fi
officecli --version

Use When

  • User wants to create a dashboard from CSV data or tabular data
  • User asks for KPI reports, analytics summaries, or metrics dashboards
  • User wants to visualize data in Excel with charts, sparklines, and conditional formatting
  • User mentions "CSV to Excel", "executive dashboard", or "data visualization"

What This Skill Produces

A single .xlsx file with:

ComponentSheetDescription
Raw dataSheet1Imported CSV with frozen headers, AutoFilter, column widths, conditional formatting
DashboardDashboardKPI cards (formula-driven), sparklines, charts (cell-range-linked), preset styling

The Dashboard sheet is active on open. All formulas recalculate on open.


Core Concepts

Formula-Driven KPIs

Every KPI value on the Dashboard is a formula referencing the data sheet. Never hardcode calculated values. When the underlying data changes, KPIs update automatically.

Cell Range References for Charts

Every chart series references data sheet cells directly (series1.values="Sheet1!B2:B13"). Charts stay in sync with data. Never use inline data unless aggregation is impossible in Excel formulas.

Chart Presets

Use preset=dashboard on charts for datasets with 10+ rows. For datasets with fewer than 10 rows, use preset=minimal. See the complexity table in A.3 of creating.md for the authoritative mapping -- when any other text in this skill conflicts with that table, the table wins. Presets are DeferredAddKeys -- they work on add only, NOT on set. A single preset replaces 5-8 manual styling properties with one consistent look.

Data-Size-Aware Complexity

The number of KPIs, charts, sparklines, and CF rules scales with the input data size. A 5-row dataset gets 1 chart and no sparklines. A 200-row dataset gets 3-5 KPIs, 2-3 charts, sparklines, and multiple CF rules.


Workflow Overview

Phase 1: Analyze the Input Data

Count rows and columns. Identify column types (date, numeric, categorical). Determine the primary dimension (X-axis). Look up the data-size-to-complexity table.

Phase 2: Plan Before Building

Decide how many KPIs, which chart types, which CF rules, and chart layout positions. Write out the plan before executing any commands.

Phase 3: Build the Workbook

Follow the 11-step workflow: create + import, column widths, Dashboard sheet, KPIs, sparklines, charts, conditional formatting, tab colors, polish, raw-set, validate.

Phase 4: QA

Run the QA checklist. Fix issues. Re-validate.

Phase 5: Deliver

Deliver the .xlsx file. Tell the user the Dashboard sheet opens first and formulas recalculate automatically.


Full Guide

Read creating.md and follow it step by step. It contains the complete workflow, decision tables, command templates, a full runnable example, and the QA checklist.


Quick Reference: Key Warnings

WarningDetail
Batch JSON valuesALL values must be strings: "true" not true, "24" not 24
Chart presetAdd-only. preset=dashboard for 10+ rows, preset=minimal for < 10 rows
Scatter chartsUse series1.xValues NOT series1.categories (causes validation error)
Reference linesFormat is value:color:label:dash (color BEFORE label)
Cell range refsAlways series1.values="Sheet1!B2:B13", never inline data
raw-set orderingactiveTab and calcPr must be the LAST commands
formulacfDo NOT use font.bold. Use fill + font.color only
Column widthsimport --header does NOT auto-size. Set widths manually on ALL sheets including Dashboard
Dashboard ###KPI cells at 24pt bold WILL show ### if Dashboard columns are not set to width=22. See Step 4b

References

  • creating.md -- Complete dashboard creation guide (the main skill file)
  • xlsx SKILL.md -- General xlsx reading, editing, and QA reference

Comments

Loading comments...