Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed report-generation connector that uploads user-selected CSV/XLSX files to a remote reporting API and does not show hidden, destructive, or persistence behavior.
Install only if you are comfortable sending selected CSV/XLSX business files to the AI Skills reporting service. Configure the API key through OpenClaw environment settings, avoid pasting full keys into chat, verify AI_SKILLS_API_URL if you override it, and use product-scoped keys if you want tighter separation.
The manifest description is written as a Chinese-only usage statement, and the rest of the skill documentation is likewise exclusively in Chinese. Under the policy, language constraints should either offer user opt-in/choice or be clearly documented as a justified region-specific limitation, which is not present here.
This file contains user-facing natural-language instructions only in Chinese, which can violate language/locale policy when no opt-in or alternative language option is provided. The content does not indicate that the skill is region-specific or that Chinese is an intentional, documented requirement.
This markdown file documents sending uploaded files via multipart/form-data and bearer tokens in HTTP requests, which can affect user privacy and system data handling. The instructions do not include any warning or disclosure that local file contents and credentials will be transmitted to a remote service.
The file’s natural-language instructions and warnings are entirely in Chinese, which can constitute a language/locale policy issue when no user choice or opt-in is provided. There is no indication that the skill is region-specific or that alternate language support is intentionally documented.
A language or locale policy violation applies across all file types when content forces a specific language without user opt-in. This file presents all operational instructions only in Chinese and does not provide an alternative language option or explain that the skill is intentionally limited to a Chinese-speaking context.
The file’s natural-language instructions and operation descriptions are entirely in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
No suspicious patterns detected.
