Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
openclaw-reportstudio-community
v1.0.0Generate polished, read-only business reports from CSV/XLSX into static deliverables (xlsx+pdf+pptx) using ReportStudio Community. Use when a user says things like “用这个表生成月报/周报/经营分析/PPT+PDF汇报材料”, provides a file path, asks for trends (day/week/month), TopN breakdowns by a dimension/metric, or wants professional exports without hallucinated claims.
⭐ 0· 977·4 current·4 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the implementation: the SKILL.md and wrapper script call the ReportStudio CLI on a local file to produce xlsx/pdf/pptx artifacts. There are no unrelated environment variables, binaries, or external services requested.
Instruction Scope
Runtime instructions stay on-task (parse user params, run reportstudio, validate artifact files, return JSON + human summary). The SKILL.md includes safety guidelines (read-only, no DB writes, avoid external network) but these are policy-level constraints and not enforced by the wrapper — ReportStudio itself (the Python module) could perform network I/O or other actions depending on its implementation. The wrapper does not read or transmit unrelated files or env vars.
Install Mechanism
No install spec is provided (instruction-only + small wrapper). Nothing is downloaded or written by the skill itself. The only runtime dependency is that a reportstudio Python package be importable/executable in the environment.
Credentials
The skill requests no environment variables, credentials, or config paths. This is proportionate to its stated purpose. The only privilege requested is the ability to run the local Python module and read the user-specified input file and write artifacts to out_dir.
Persistence & Privilege
always is false and the skill does not request persistent presence or modify other skills or system-wide config. It spawns a subprocess to run reportstudio on-demand, which is appropriate for its function.
Assessment
This skill appears to do exactly what it says: run a local ReportStudio CLI on a CSV/XLSX and return artifacts. The primary remaining risk is that it will execute whatever 'reportstudio' code is available in the Python environment — that code could perform network requests, access other files, or be malicious if you installed an untrusted package. Before installing/using: (1) ensure the reportstudio package you rely on is from a trusted source or run the skill in an isolated virtualenv/container, (2) avoid passing sensitive files unless you have verified ReportStudio's behavior, (3) do not point repo_dir at untrusted locations, and (4) run the acceptance checklist (references/acceptance.md) and an interactive python -m reportstudio.cli.main --help to confirm behavior. If you need stronger guarantees, require network egress controls or run in a locked-down sandbox.Like a lobster shell, security has layers — review code before you run it.
latestvk97anb99xmcw72w5bdc8dr5yv580ym5a
License
MIT-0
Free to use, modify, and redistribute. No attribution required.