work attendance skill

Summary of what to consider before installing/running: - Functionality: The skill appears to do what it says (attendance analysis for the named branches) and includes a substantial Python script implementing the business rules. The SKILL.md and examples are consistent with the script's logic (exclusions, sub-department splitting, weekend-rotation rules). - Packaging gaps (reason for 'suspicious'): The package has no install specification or dependency list. The script requires Python and the openpyxl package (it errors out if openpyxl is missing), and SKILL.md promises .docx and .xlsx outputs but the included script only advertises structured JSON output — there is no explicit code or declared dependency to create .docx/.xlsx files. You (or the agent runtime) will likely need to install Python packages manually (openpyxl, and possibly python-docx or a writer for Excel files) or implement the conversion. This mismatch can cause runtime surprises. - Security & privacy: The skill processes sensitive HR data (employee names, IDs, attendance). The included code does not appear to make network calls or exfiltrate data (no requests/urllib/sockets in the provided code), but you should still: (1) review the full script yourself to confirm there are no hidden network callbacks, (2) run it in an isolated/sandbox environment if possible, and (3) avoid sharing the raw Excel with untrusted services. - Recommended actions before use: - Inspect the full analyze-attendance.py for any network I/O or os.system/subprocess calls (the provided snippet shows none, but verify the remainder of the file). - Ensure you have a trusted Python runtime and install required packages (pip install openpyxl and any library you choose for generating .docx/.xlsx). Consider using a virtual environment. - If you expect the skill to autonomously write .docx/.xlsx, either add or confirm code to perform those writes (and include any needed libraries) or be prepared to convert the JSON output to docx/xlsx yourself. - Because the publisher is unknown, prefer running on non-production or anonymized test data first. - What would change this assessment: If the skill metadata were updated to declare required Python packages and an install spec (or included code that actually writes .docx/.xlsx), the packaging concerns would be resolved and the verdict could move to benign. Conversely, discovery of network/credential access in the rest of the code would increase severity and confidence toward malicious.