Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Smart Dashboard

v1.0.4

Upload CSV/Excel files and describe your visualization needs in natural language to get AI-recommended professional charts with PNG export.

0· 38·0 current·0 all-time
byYK-Global@billjamno58

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for billjamno58/smart-dashboard.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Smart Dashboard" (billjamno58/smart-dashboard) from ClawHub.
Skill page: https://clawhub.ai/billjamno58/smart-dashboard
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install smart-dashboard

ClawHub CLI

Package manager switcher

npx clawhub@latest install smart-dashboard
Security Scan
Capability signals
CryptoCan make purchasesRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
Name/description promise (local processing, simple CSV→PNG charting) mostly matches the code's purpose, but the manifest/registry omits several capabilities the code requires: runtime network calls to AI providers and skillpay.me, and a Node-based screenshot step. The code legitimately needs an AI API key and an optional billing builder key, but those env vars are not declared in registry metadata. Also the web UI requires a local server and Node for screenshot generation which the description and registry do not mention.
!
Instruction Scope
SKILL.md states 'All processing is local, no server upload', but chart_recommender sends dataset overview/preview and prompt text to external AI provider endpoints (OpenAI/Claude/Zhipu/MiniMax). The code also POSTs to skillpay.me for billing. The instructions expose user-provided data (preview rows / column info) to external services — this is expected for an 'AI recommendation' feature but contradicts the 'local-only' claim. SKILL.md lists AI-related env vars but the runtime code also uses SKILLPAY_API_KEY (billing) which is not documented in registry requires.env.
!
Install Mechanism
There is no install spec in the registry, but requirements.txt indicates Python deps (pandas, pyecharts, requests, openpyxl). The renderer writes a small Node.js script and calls node/puppeteer (via subprocess), yet the manifest does not declare Node or puppeteer as required. Missing install steps for Node/puppeteer and no guarantee those binaries/libraries exist is a deployment/operational mismatch and increases risk if users run code assuming only Python deps are needed.
!
Credentials
Registry metadata lists no required env vars, but SKILL.md instructs users to provide AI_API_KEY, AI_PROVIDER, AI_MODEL. The code also checks SKILLPAY_API_KEY for billing (billing.py). This is an incoherence: required credentials for external services are needed but not declared in metadata. The AI API key is proportionate to the AI recommendation feature, but SKILLPAY_API_KEY (builder/billing key) is unexpected for an end user and is not documented in SKILL.md's 'Env Variables' table.
Persistence & Privilege
The skill does not request 'always' presence and does not attempt to modify other skills. It writes files under BASE_DIR (/tmp/smart-dashboard) and stores usage.json and temporary scripts there; this is local persistence scoped to /tmp, not system-wide. It uses subprocess to run node and writes a temporary _screenshot.js — behavior is privileged relative to a read-only skill but limited in scope.
What to consider before installing
This skill contains multiple mismatches you should resolve before use: - Data exfiltration: Although SKILL.md claims 'all processing is local', the recommender sends dataset preview and prompt content to external AI providers (OpenAI/Claude/Zhipu/MiniMax). If your data is sensitive, do not provide an AI API key or upload real data until you confirm how much is sent and to which provider. - Undeclared credentials and billing: The code expects an AI_API_KEY (documented in SKILL.md) and also references SKILLPAY_API_KEY (billing) — the registry shows no required env vars. Ask the publisher to declare all required env vars (including SKILLPAY_API_KEY) and explain when billing/charge calls occur. - Missing runtime requirements: The renderer uses Node/puppeteer via subprocess to convert HTML to PNG, but Node/puppeteer are not declared in install instructions. If you run this, ensure Node and puppeteer are installed in a sandboxed environment. - Network endpoints: The code will POST to external endpoints (api.openai.com, api.anthropic.com, open.bigmodel.cn, api.minimax.chat and skillpay.me). Only install/run this if you trust those endpoints and are comfortable that dataset previews may be transmitted. - Packaging oddities: The web app tries to import 'clawhub.billing' while billing.py is provided at repo root — confirm the package layout before running. Also consider running the code in an isolated VM/container, review the code yourself (or have a developer do so), and ask the publisher to fix manifest/metadata inaccuracies (declare env vars, document Node dependency, and correct the 'local processing' claim).

Like a lobster shell, security has layers — review code before you run it.

latestvk976v575bq8qk9hs1vndwy8v5x85n5wk
38downloads
0stars
5versions
Updated 7h ago
v1.0.4
MIT-0

Smart Dashboard Generator

One sentence, one chart — Upload a CSV/Excel file, describe what you want in natural language, and AI generates professional charts instantly.


Overview

Smart Dashboard Generator is an AI-powered data visualization tool that recommends and renders the best chart types based on your data and natural language requests.


Features

Core Capabilities

  • File Upload — Parse CSV and Excel (.xlsx/.xls) automatically
  • AI Chart Recommendation — Automatically suggest optimal chart types based on data structure
  • Multi-Chart Generation — Generate multiple related charts in one request
  • PNG Export — Download high-resolution chart images
  • Data Overview — Display row/column count, column names, data types

Supported Chart Types

Chart TypeBest For
BarCategory comparison
LineTrends over time
PieProportion/composition
ScatterRelationship between variables
HeatMapDensity distribution
RadarMulti-dimensional comparison
GaugeKPI display
FunnelConversion funnel

Usage

Step 1: Upload Data File

Upload a CSV or Excel file. The system automatically parses field types.

Step 2: Describe Your Request

Use natural language to describe the chart you want:

  • "Show monthly sales trends"
  • "Compare product category sales"
  • "Display user age distribution"

Step 3: Get AI Recommendation

AI recommends the best chart types based on your data and request.

Step 4: Download Chart

Export charts as PNG format, ready for reports and presentations.


Pricing

TierPriceData RowsFeatures
FREEFree500 rows10 uses total, basic charts
PRO$0.01 USDT/useFullAll chart types, unlimited

FREE tier: 10 total uses (not per month), 500 row limit per file.


Billing

This skill uses SkillPay for billing.


Env Variables

VariableDescription
AI_API_KEYYour API key for AI recommendations
AI_PROVIDERAI provider: openai, claude, zhipu, minimax
AI_MODELSpecific model (optional)

Supported AI Providers

  • OpenAI (GPT-4o) — export AI_PROVIDER=openai
  • Claude (Claude 3.5 Sonnet) — export AI_PROVIDER=claude
  • Zhipu GLMexport AI_PROVIDER=zhipu
  • MiniMaxexport AI_PROVIDER=minimax

Technical Details

  • Data Parsing — pandas for CSV/Excel processing
  • Chart Rendering — Apache ECharts (pyecharts)
  • AI Recommendation — Bring your own API key (OpenAI/Claude/GLM/MiniMax)
  • Data Security — All processing is local, no server upload

Limitations

  • FREE tier: 10 total uses (not monthly), 500 row limit
  • Recommended file size under 10MB
  • AI features require your own API key

Comments

Loading comments...