Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Excel Report

v1.0.0

生成包含专业配色、公式自动刷新的多行业Excel可视化报表,支持批量处理与邮件发送。

1· 47·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The name/description (Excel visual reports, templates, batch output, email) align with the included Python modules (data_parser, template_engine, chart_builder, generate_report) and JSON templates. However registry metadata declares no required environment variables while the SKILL.md and generate_report.py expect SMTP_HOST/SMTP_USER/SMTP_PASSWORD for the email feature. Also rapidfuzz is optionally used by data_parser if installed but is not mentioned in SKILL.md.
Instruction Scope
SKILL.md instructs running the included Python scripts on local data files and, if emailing is used, to set SMTP_* env vars. The runtime instructions only reference local paths within the skill (templates, sample_data, output) and standard Python libraries. They do not instruct reading unrelated system paths. Note: the email feature will transmit generated files (attachments) to external SMTP servers when used.
Install Mechanism
There is no automated install spec or remote download; this is instruction-plus-bundled-code. All code is plain Python shipped in the skill bundle (no obfuscated or remote fetch). Risk from installation is low, but installing the bundle writes these scripts and templates to disk (the SKILL.md suggests placing it under ~/.qclaw/skills/excel-report/).
!
Credentials
The skill requires SMTP credentials to enable its email-sending feature (SKILL.md: SMTP_HOST, SMTP_USER, SMTP_PASSWORD) but the registry's required-env list is empty—this mismatch should be corrected. Aside from SMTP credentials, the skill does not request unrelated secrets (no cloud/AWS/etc.). The email credentials are proportional to the stated feature but are sensitive and grant the skill ability to send files externally.
Persistence & Privilege
The skill does not request always:true or elevated agent/system privileges. It does not modify other skills or global agent settings. Normal autonomous model invocation is allowed (platform default).
Assessment
What to consider before installing: - The package appears to do what it claims (parse data, apply templates, build charts, save Excel files). The code is local Python — no remote downloads — which reduces risk. - If you plan to use the email feature: it requires SMTP_HOST / SMTP_USER / SMTP_PASSWORD (not listed in the registry metadata). Providing SMTP credentials lets the script connect to that SMTP server and send attachments; use a dedicated, limited mailbox (not your primary account) and strong, revocable credentials. - Review generate_report.py's email logic before using to confirm which files it attaches and which recipient addresses it allows (ensure it only sends intended reports and cannot be tricked into attaching arbitrary local files). - The SKILL.md omits the optional rapidfuzz dependency used for fuzzy column mapping; if you rely on fuzzy matching, install rapidfuzz or expect degraded mapping behavior. - Run the skill first in a sandbox or on non-sensitive sample data to confirm behavior (where the output directory is SKILL_DIR/output). Check logs/output for unexpected network activity. - If you need the registry metadata to reflect runtime needs, ask the skill author to declare the SMTP env vars (and any other optional dependencies) so capability and required credentials are explicit. If you want, I can: (a) point to the exact lines where SMTP env vars and email-sending behavior occur in generate_report.py, (b) extract and summarize the email send routine, or (c) list all places the code reads files and environment variables.
scripts/template_engine.py:141
Dynamic code execution detected.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk973v5493nqp2wscgefhrv162583yfnx

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments