Qlik Cloud

Complete Qlik Cloud analytics platform integration with 37 tools. Health checks, search, app management, reloads, natural language queries (Insight Advisor), automations, AutoML, Qlik Answers AI, data alerts, spaces, users, licenses, data files, and lineage. Use when user asks about Qlik, Qlik Cloud, Qlik Sense apps, analytics dashboards, data reloads, or wants to query business data using natural language.

Before installing, note these issues and take steps to mitigate risk: - The skill's scripts and SKILL.md require QLIK_TENANT and QLIK_API_KEY, but the skill registry metadata did not declare those env vars or a primary credential. Ask the publisher to update the metadata (primaryEnv should be QLIK_API_KEY and requires.env should include QLIK_TENANT and QLIK_API_KEY). - Review the included scripts yourself (they are plain bash + small python3 JSON parsers). They call only the Qlik tenant URL you supply; they do not call other external endpoints. Still, verify the tenant URL you provide is correct and trusted. - Use least-privilege API keys: create an API key with the minimum privileges needed (read-only where possible) and test in a non-production tenant or with a low-privilege account first. Revoke the key if you later stop using the skill. - Because some scripts trigger actions (delete app, run automations, trigger alerts, run reloads), restrict who can invoke the skill and confirm operator intent before running destructive actions. - The delete script writes a temporary file to /tmp; ensure your environment's /tmp is monitored if that's a policy concern. - If you require higher assurance, ask the publisher for an updated package that correctly declares required env vars and a primary credential, and for a short explanation of why each API action is needed. Confidence note: The behavior appears to match the advertised purpose and no obvious exfiltration patterns are present, but the metadata omissions and the fact this package contains executable scripts rather than being purely declarative make this suspicious rather than outright benign.

Type: OpenClaw Skill Name: qlik-cloud Version: 1.0.3 The skill bundle provides a comprehensive integration with Qlik Cloud, allowing an AI agent to interact with its API for various tasks. All scripts correctly handle credentials (QLIK_TENANT, QLIK_API_KEY) as environment variables and direct network calls exclusively to the specified Qlik Cloud tenant. User input is safely handled via JSON encoding or URL encoding before being sent in API requests, preventing injection. The documentation (SKILL.md, README.md) provides clear, helpful instructions without any evidence of prompt injection attempts against the agent. No indicators of data exfiltration, malicious execution, persistence, or obfuscation were found.