team-efficiency-daily-report

Generate team efficiency daily report automatically

Security Scan

The skill's code, instructions, and dependencies are consistent with its stated purpose (automating a browser to capture dashboard XHR, fetch data, and generate local Markdown reports), but it performs authenticated browser requests that can expose sensitive dashboard payloads so review before use.

Purpose & Capability

The name/description match the implementation: the code uses Puppeteer (browser automation), captures XHR payloads, modifies time ranges, calls the data API, parses results and writes JSON/Markdown reports. The package.json dependencies and the included utils (api/parser/report) are appropriate for this functionality. Example config contains corporate dashboard/dataAPI endpoints which are consistent with intended use.

Instruction Scope

SKILL.md tells the agent to run 'node dist/index.js' and configure config.json; the code will open the provided dashboard URL, listen to page requests to capture POST payloads for the configured dataAPI, then perform fetch() from the page context. This is within scope, but capturePayload will record request bodies (postData) and requestAPI runs fetch in the page context (so requests run with the page's cookies/credentials). That means the skill will operate using whatever authenticated session the browser provides — review this because captured payloads and in-page fetches can include sensitive data.

Install Mechanism

There is no install spec (instruction-only), but the bundle includes code and package.json declaring puppeteer / puppeteer-core and @bondli-skills/shared. Running/installing may pull Chromium (puppeteer) and requires Node runtime. No arbitrary external downloads or obscure URLs appear in the package itself, but the shared dependency isn't included in this bundle so you should vet it separately.

Credentials

The skill declares no required environment variables or credentials and writes files to ~/openclaw-skill-data/team-efficiency-daily-report/. That is proportionate. However, it relies on an authenticated browser session (login) to access protected dashboards and will capture XHR payloads and perform authenticated fetches — effectively it can read whatever data your browser session has access to even though no explicit credentials are requested.

Persistence & Privilege

always is false and the skill does not modify other skills or system-wide settings. It creates and writes only to its own directory under the user's HOME. There is no elevated/system persistence requested by the package.

Assessment

This skill appears to do what it says (use a browser to capture dashboard XHR and generate local reports), but review before installing: 1) It requires running a browser session and will capture POST payloads and perform fetches using the page's authenticated context — any sensitive tokens or confidential data accessible in that session may be captured. 2) Examine the @bondli-skills/shared dependency (connectBrowser) before use to ensure it doesn't reuse your primary browser profile or exfiltrate data. 3) Edit config.json to point to only the dashboards/APIs you trust (the example includes internal corporate URLs). 4) Consider running it in an isolated account or VM if you are not comfortable giving it access to your main authenticated browser session. 5) Be aware Puppeteer may download Chromium at install time and the skill will write data into ~/openclaw-skill-data/team-efficiency-daily-report/.

Generate team efficiency daily report automatically.

What this skill does

This skill will:

1. Open the configured dashboard URL
2. Capture the XHR API request payload
3. Modify query time range if need:
   • startTime = first day of current month
   • endTime = today
4. Call the API to fetch data
5. Parse efficiency metrics
6. Save today's data locally
7. Generate a markdown daily report

Usage

When the user asks something like:

• 生成团队效能日报
• 查询团队效能数据
• 生成效能分析日报

Run: node dist/index.js

Output

The skill will generate:

~/openclaw-skill-data/team-efficiency-daily-report/YYYY-MM-DD.json ~/openclaw-skill-data/team-efficiency-daily-report/YYYY-MM-DD.md

Example:

~/openclaw-skill-data/team-efficiency-daily-report/2026-03-13.md

Configuration

Report configuration is defined in:

config.json

It contains:

• dashboard url
• data API
• metric column mapping
• need to modify request params