Nex Reports

Automated report generation and scheduling meta-skill that aggregates data from multiple Nex tools into unified, actionable business briefings for day-to-day...

This package is largely coherent with its stated purpose, but proceed cautiously: - Inspect setup.sh before running it (it will be executed by the Quick Start and can modify your user environment). - Treat IMAP_PASS and TELEGRAM_TOKEN as sensitive — use app-specific passwords where possible and store them securely (not in public shells or logs). - The CUSTOM module executes arbitrary shell commands from report configs; avoid adding untrusted commands and consider running this tool under a dedicated user with limited permissions or in a sandbox if you plan to use CUSTOM. - Review the code (modules.py and setup.sh) locally to confirm there are no hidden network endpoints or unexpected behavior before installing on production systems. If you want higher confidence, provide the contents of setup.sh and the remainder of modules.py (the CUSTOM/run_module implementation) so they can be reviewed specifically for shell invocation semantics (shell=True, command interpolation) or unexpected network calls.

Type: OpenClaw Skill Name: nex-reports Version: 1.0.0 The nex-reports skill bundle is a reporting tool that aggregates data from various sources, including email and external CLI tools. It is classified as suspicious due to high-risk capabilities, most notably the 'CUSTOM' module in 'lib/modules.py' which executes arbitrary shell commands using 'subprocess.run(shell=True)'. The tool also manages sensitive credentials (IMAP passwords and Telegram tokens) and accesses email headers. While these features are aligned with the stated purpose of automated reporting, they provide a significant attack surface for command injection and credential exposure. No evidence of intentional malice or unauthorized data exfiltration was found.