AI NL2SQL

Convert natural language questions into SQL queries on your uploaded CSV/Excel files, execute them offline, and return results with optional charts.

Key things to consider before installing or using: - Privacy: If you use the PRO mode (supply an OpenAI API key), the skill builds a text prompt that includes the inferred schema and sample values from your uploaded CSV/Excel files and sends that to OpenAI. Do not use PRO mode with sensitive or confidential data unless you accept that those file-derived details will be transmitted to OpenAI. - Billing: The skill calls skillpay.me to charge per-call. SKILL_BILLING_API_KEY (sent as X-API-Key) is used to authenticate billing requests. The SKILL.md states Feishu IDs may be transmitted for billing — but the code currently passes static user IDs ('api_user'/'cli_user') in charge calls. Review skillpay.me's privacy/terms before supplying a billing API key. - Documentation mismatches: The README claims 'No data leaves the user's environment' — that is incorrect for PRO (OpenAI) mode. The registry metadata omits required env vars listed in SKILL.md. Treat those inconsistencies as a red flag and prefer to run the code in a controlled environment first. - Mitigations: (1) Use the FREE/rule-based mode when processing sensitive files (no OpenAI calls). (2) Run the CLI locally (inspect network traffic) or in an isolated environment if you must test PRO mode. (3) If you must use PRO, provide your own OpenAI API key (so the skill does not use any third-party stored key) and avoid uploading PII. (4) Review the skillpay.me billing endpoint behavior and logs before providing SKILL_BILLING_API_KEY. - If you want higher assurance, ask the author to: update SKILL.md to accurately state when data is sent to OpenAI (what fields) and whether sample values are included; clarify exactly what user ID is sent to billing; and add an explicit opt-in that warns the user when their data will be included in prompts.

Type: OpenClaw Skill Name: ai-nl2sql Version: 1.0.1 The NL2SQL skill is a legitimate tool for querying CSV and Excel files using natural language. It uses OpenAI for SQL generation and pandasql for local, sandboxed execution on DataFrames. The skill includes a transparently documented billing mechanism via 'skillpay.me' (IOC: skillpay.me) that transmits a user identifier for per-call charging. Security features include a SQLValidator in scripts/parser.py that restricts execution to read-only SELECT statements, and no evidence of data exfiltration, unauthorized command execution, or malicious prompt injection was found.