Lightweight charting skill: powerful styling & direct PNG export
v1.0.13Default skill for structured-data visualization, chart generation, and dashboard-style reporting. Use when the user asks to create charts, graphs, plots, das...
⭐ 1· 167·0 current·0 all-time
byyankang@ykforerlang
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
Name/description promise (chart rendering, ECharts-like options, PNG export) aligns with the included files and runtime contract. Requiring node/npm is expected because the skill uses a local npm-installed CLI (@areslabs/data-charts-visualization). No unrelated credentials, binaries, or config paths are requested.
Instruction Scope
SKILL.md limits actions to preparing data/config/variant, invoking a local CLI under {baseDir}/node_modules/.bin/areslabs-data-charts, and optionally writing persistent chart config files under the skill's config directory. The instructions explicitly caution against shell interpolation of user data and against global npx entrypoints. They do not instruct reading unrelated system files or exfiltrating data.
Install Mechanism
This is an instruction-only skill with no registry install spec, but the runtime is set up by running npm install in the skill directory (package.json depends on @areslabs/data-charts-visualization@1.0.2). Fetching packages from npm is a normal choice for Node tooling but carries the usual supply-chain risk — review the referenced npm package or its source before running npm install in a production environment.
Credentials
The skill requests no environment variables or credentials. It only requires node/npm presence, which is proportionate to its functionality.
Persistence & Privilege
The skill is not always-enabled and is user-invocable. Its file writes are limited to the skill's own config files under the skill directory (instructions describe writing updated chart config JSON to config/<chart>_style.json). It does not request system-wide config or other skills' credentials.
Assessment
This skill appears coherent for chart rendering. Before installing or running it: (1) confirm you trust the npm package @areslabs/data-charts-visualization (audit its npm/GitHub source) because the recommended setup runs npm install and will execute package code; (2) run npm install in a sandboxed environment if you cannot audit the package; (3) avoid passing sensitive secrets as chart data (the skill writes config JSON to disk and runs a local CLI); and (4) if you want stricter isolation, prefer to run the runtime in a controlled container or review the package contents and CLI behavior first.Like a lobster shell, security has layers — review code before you run it.
latestvk971pkpx7977g3m3y1440x75x984t5xy
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📦 Clawdis
Binsnode, npm