sql-reports

Connects to SQL Server to retrieve and generate monthly, quarterly, and yearly delivery order reports with performance comparisons and growth metrics.

Security Scan

The skill claims to query a delivery DB but contains hard-coded database credentials, mismatched documentation vs code, and unadvertised access to an internal SQL Server — the footprint is inconsistent and risky.

Purpose & Capability

The skill's stated purpose (generate monthly/quarterly/yearly delivery reports) matches the presence of SQL query code, but there are inconsistencies: SKILL.md names the Database as 'DeliveryDB' while query.py uses 'PDFExtraction'; SKILL.md documents queries like 'monthly_comparison' and 'quarterly_report' that are not implemented in query.py. The core capability (querying SQL Server) is coherent but the documentation and implementation disagree.

Instruction Scope

SKILL.md tells the agent to connect to LTEDP056\SQLEXPRESS and install ODBC/pyodbc, which is appropriate for a SQL-reporting skill. However, SKILL.md does not mention credentials, while query.py contains a hard-coded connection string (server, DB, UID, PWD) and will print full query results to stdout. The instructions do not declare or constrain use of these embedded credentials or the sensitivity of the returned data.

Install Mechanism

No install specification is provided; this is an instruction+code skill that relies on Python and pyodbc. That is a low install risk (nothing is downloaded/installed by the skill itself).

Credentials

The code contains plaintext DB credentials (UID=ptcl-bot; PWD=ptcl-bot123) and a hard-coded server name, yet the skill declares no required environment variables or primary credential. Requesting/including credentials in the code (instead of using declared/env-provided secrets) is disproportionate and insecure. The skill also requires network access to an internal host, which is not explicitly represented in metadata.

Persistence & Privilege

The skill is not always-enabled and does not request persistent system-wide privileges or modify other skills. Execution simply runs query.py and yields outputs; autonomous invocation is allowed by platform default but is not combined here with elevated privileges.

What to consider before installing

Do not run this skill against your environment without review. Specific concerns: (1) query.py contains plaintext DB credentials and a hard-coded server — treat these as sensitive and potentially invalid or stale; (2) SKILL.md and the code disagree on the database name and available queries, so functionality may be incomplete or incorrect; (3) running the script will print database rows (possibly sensitive PII/product data) to stdout. Before installing: ask the publisher for the correct architecture and for removal of embedded credentials; require credentials be provided via secure environment variables or a secrets store and documented in the skill metadata; validate the queries and least-privilege DB account; run any untrusted code in an isolated environment and audit network destinations. If these fixes are not made, consider the skill unsafe to use.

Query Delivery Orders from SQL Server and generate delivery reports for business analysis.

Overview

This skill connects to a SQL Server database to extract and analyze delivery order data. It's designed for warehouse managers and logistics teams who need quick access to delivery statistics without writing SQL queries manually.

Database Connection

• Server: LTEDP056\SQLEXPRESS
• Port: 1433
• Database: DeliveryDB
• Driver: ODBC Driver 17 for SQL Server

Prerequisites

1. Python 3.8+ installed
2. pyodbc library installed: pip install pyodbc
3. ODBC Driver 17 for SQL Server installed on Windows
4. Network access to LTEDP056 server on port 1433

Available Queries

1. summary_by_month

Returns monthly delivery summary with total orders, revenue, and delivery status breakdown.

Output: Table with Month, TotalOrders, TotalRevenue, Delivered, Pending, Cancelled columns

2. monthly_comparison

Compare delivery performance between two months.

Input: Month1 (YYYY-MM), Month2 (YYYY-MM) Output: Side-by-side comparison table

3. quarterly_report

Generate comprehensive quarterly delivery report with trends.

Input: Year (YYYY), Quarter (1-4) Output: Detailed report with weekly breakdown

4. summary_by_year

Annual delivery summary with year-over-year growth metrics.

Input: Year (YYYY) Output: Annual statistics and growth indicators

Usage

Run from command line:

python query.py summary_by_month
python query.py monthly_comparison 2025-01 2025-02
python query.py quarterly_report 2025 1
python query.py summary_by_year 2025