Data Report Generator — CSV/Excel to Word/PDF with Charts

ReviewAudited by ClawScan on May 10, 2026.

Overview

The report-generation purpose is coherent, but the skill tells the agent to install unpinned Python packages using a system-package override that can alter the user’s Python environment.

Only use this skill on files you intend to analyze, and do not run the provided pip command directly in your system Python environment. Prefer a virtual environment with pinned package versions, then generate reports from selected local files.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill’s dependencies as written could change or break the user’s local Python setup, and the exact package versions installed may vary over time.

Why it was flagged

The skill instructs package installation during use, with unpinned dependencies and the --break-system-packages flag. That can pull changing code from a package index and modify a system-managed Python environment instead of using a safer isolated environment.

Skill content

Install dependencies first:

```bash
pip install matplotlib seaborn pandas openpyxl --break-system-packages --quiet
```

Recommendation

Use a virtual environment or pinned dependency file instead of --break-system-packages, and ask the user before installing packages.