Sales Dashboard

Aggregate sales data from OKKI CRM and Campaign Tracker to generate weekly/monthly reports with alerts and push them to Discord.

Security Scan

The skill's stated purpose (aggregate OKKI + campaign data and push reports to Discord) is plausible, but the package quietly reads and writes other local workspaces and config files (including absolute /Users/wilson paths and a token cache) without declaring any required credentials — this mismatch is concerning.

Purpose & Capability

The description says it pulls from OKKI CRM and optional local files and pushes to Discord, which matches the scripts' high-level behavior. However, config/dashboard-config.json contains absolute paths into another user's workspace (e.g. /Users/wilson/.openclaw/workspace/xiaoman-okki/...) and references other skill workspaces (campaign-tracker, follow-up-engine, etc.). The skill did not declare any required environment variables or credentials, yet the code expects and will read other projects' config/token files. Accessing unrelated workspace paths is disproportionate to the stated purpose and unexpected.

Instruction Scope

The SKILL.md instructs running the included node scripts, but the scripts read arbitrary local files and environment variables beyond what's documented: they load .env (ENV_PATH), look for OKKI client/config files and token.cache in an OKKI_WORKSPACE, and reference other skills' scripts/dirs. They also write snapshots, logs, and token cache files. The SKILL.md does not disclose these filesystem accesses or that it will read other skills' project files, which is scope creep.

Install Mechanism

There is no external install step or remote download; this is an instruction-only skill with bundled JS files. That lowers install risk (no remote code fetch), but the included code will run on the host and access local files when invoked.

Credentials

The registry metadata shows no required env vars or credentials, but the code loads a .env, honors OKKI_WORKSPACE/ENV_PATH environment variables, and reads OKKI API config (which may include clientId/clientSecret) and a token cache. The skill can therefore read secrets from local config files without declaring them. It also writes token.cache into the referenced OKKI workspace, giving it write access into other project areas — this is disproportionate and surprising given the declared requirements.

Persistence & Privilege

always:false (normal), but the scripts create and update files: data/snapshots, data/latest.json, logs/, reports/, and importantly OKKI_TOKEN_CACHE inside the referenced OKKI_WORKSPACE. That means the skill can modify files in other workspaces if paths resolve, giving it a persistent footprint outside its own directory. Autonomous invocation is allowed by default (not flagged alone) and would increase blast radius given the file-access behavior.

What to consider before installing

Before installing or enabling this skill: - Inspect config/dashboard-config.json and any referenced OKKI client/config files. The config contains absolute paths to /Users/wilson/... and other skill workspaces — if those exist on your system the skill will read them (and may read credentials inside). - Treat the skill as requiring access to local secrets even though no env vars are declared: it loads .env files and OKKI API config (which can contain client_id/client_secret) and will request tokens from the OKKI token endpoint. - If you do not want it to access other projects, change OKKI_WORKSPACE and ENV_PATH environment variables (or sanitize the config) to point to a safe location, or remove/replace absolute paths in config/dashboard-config.json before use. - Because the collector writes a token cache and logs into the referenced OKKI workspace, run the skill in an isolated environment (container or dedicated account) if you cannot fully audit the referenced files. - Consider requesting the publisher to: 1) remove hard-coded absolute paths, 2) declare required env vars/credentials in registry metadata, and 3) make explicit what external files it needs and why. If you can't verify those changes, avoid giving this skill autonomous invocation or run it only manually with dry-run options. If you want, I can: point out the exact lines that read/write external paths, help create a sanitized config, or suggest a safe sandbox command to run the scripts for testing.

Sales Dashboard 销售仪表盘

描述

渐进式销售数据概览，从 OKKI CRM 和 Campaign Tracker 采集核心指标，生成周报/月报，通过 Discord 推送。

架构

scripts/
├── data-collector.js      # 数据采集（OKKI API + 可选数据源）
├── metrics-calculator.js  # 指标计算（漏斗 + 环比 + 异常检测）
├── report-generator.js    # Markdown 报告生成（周报/月报）
└── discord-push.js        # Discord 推送（自动分片 >1800 字符）

config/
└── dashboard-config.json  # KPI 定义 / 数据源映射 / 告警阈值

data/
├── latest.json            # 最新一次采集的指标
├── calculated.json        # 计算后的指标（含漏斗/告警）
├── snapshots/             # 历史快照（{period}-{date}.json）
└── reports/               # Markdown 报告

数据源

数据源	必选	类型	说明
OKKI CRM	✅	API	客户/订单/报价/线索/商机
campaign-tracker	❌	文件	邮件发送量/回复率
follow-up-engine	❌	文件	跟进数据
order-tracker	❌	文件	订单跟踪
customer-segmentation	❌	文件	客户分群
pricing-engine	❌	文件	定价数据

缺失的可选数据源显示 N/A，不报错。

用法

采集数据

node scripts/data-collector.js --period weekly [--date 2026-03-24] [--dry-run]
node scripts/data-collector.js --period monthly [--date 2026-03-01]

计算指标

node scripts/metrics-calculator.js --check-alerts

生成报告

node scripts/report-generator.js --period weekly [--dry-run]
node scripts/report-generator.js --period monthly

Discord 推送

# 推送最新周报
node scripts/discord-push.js --latest-report weekly

# 推送指定报告
node scripts/discord-push.js --report data/reports/weekly-2026-03-24.md

# 手动告警
node scripts/discord-push.js --alert "⚠️ 订单金额异常下降"

定时任务（OpenClaw cron）

任务	Cron ID	时间	说明
周报	bbdf51a8-36e0-4ee9-824b-0c92f7a44bf1	每周一 09:00 CST	采集 + 计算 + 生成 + 推送
月报	13e4378e-655e-4082-8bc0-c8fbd8e91c12	每月 1 日 09:00 CST	采集 + 计算 + 生成 + 推送

告警阈值（保守初始值）

指标	条件	阈值
邮件回复率	低于	10%
订单金额	环比下降超	50%
周订单数	等于	0

历史快照机制

每次采集保存 data/snapshots/{period}-{date}.json，永不覆盖。 data/latest.json 每次更新为最新数据。 环比计算自动读取上一期快照。

已知问题 & 改进记录

v1.0.1 (2026-03-25)

• 修复: Campaign Tracker reply_rate 从小数 (0.667) 正确转换为百分比 (66.7%)
• 修复: Campaign Tracker JSON 报告嵌套 metrics 字段兼容
• 新增: OpenClaw cron 定时任务（周报 + 月报）已创建
• 验证: OKKI API 时间过滤正常工作（start_time/end_time/time_type 参数）
• 验证: 历史快照机制正常（data/snapshots/）
• 待优化: OKKI 沙盒环境数据为空（全 0），切换生产环境后验证

---

版本: 1.0.1 创建: 2026-03-25 更新: 2026-03-25