Report Creator

Use when the user wants to CREATE or GENERATE a report, business summary, data dashboard, or research doc — 报告/数据看板/商业报告/研究文档/KPI仪表盘. Handles Chinese and Eng...

This skill appears to do what it says: generate and validate .report.md IR into single-file HTML reports using local templates and guard checks. It does not request credentials or install arbitrary remote binaries. Before installing or running it: 1) Inspect SKILL.md for any hidden/control characters (the scanner flagged 'unicode-control-chars'); remove or decode them if present. 2) If you install by cloning the GitHub repo, review scripts (scripts/*.py) to ensure they don't call unexpected network endpoints or execute untrusted code in your environment. 3) Run tests locally in a sandboxed environment if possible (repo includes tests and eval scripts). 4) Avoid pasting SKILL.md or other large skill files wholesale into online LLM prompts without first checking for hidden characters. 5) Because the skill can be invoked autonomously by the agent, only enable it for agents/contexts you trust. If you need higher assurance, request the authoritative upstream repo URL and verify commit history before use.

Type: OpenClaw Skill Name: report-creator Version: 1.21.2 The skill bundle contains high-risk capabilities, specifically shell command execution via 'subprocess.run' in 'scripts/verify-release.py' and browser automation using Playwright in 'scripts/export-image.py'. An internal validation report ('reports/validate.json') explicitly flags these as 'dangerous calls' (Rule R75). While these scripts appear to serve legitimate purposes like automated testing and report-to-image conversion, they represent a significant attack surface if the agent is manipulated into executing them with unintended inputs. No evidence of intentional malice, such as data exfiltration or unauthorized persistence, was detected.