导购个人业绩分析

导购个人业绩深度分析工具。支持普通门店（POS数据）和AIoT门店（POS+AIoT数据）。 输出导购个人详细诊断报告，包含： 1. 核心业绩指标（销售额、排名、业绩占比） 2. 雷达图能力对比（6维能力 vs 门店平均） 3. 商品特征分析（品类/价格带/包型/颜色/新品偏好） 4. Top5 SKU爆品分析（...

This skill appears to implement the analysis it claims, but before installing you should: 1) Review the api_client implementation (get_api_client) that the skill imports — confirm what credentials/tokens it uses and what endpoints it can call; the skill will run API calls using that client. 2) Remove or correct the hard-coded development path (/Users/yangguangwei/...) and the implicit sys.path inserts so the skill doesn't depend on a specific user's workspace. 3) Verify that the api_client's credentials are scoped to only the needed copilot/guide endpoints (least privilege) and cannot be used to access unrelated sensitive APIs or exfiltrate data. 4) Test the skill in a sandbox account with non-sensitive store data first. 5) If you need stronger guarantees, require the skill to accept an explicit, scoped credential or client factory (documented in SKILL.md) rather than relying on implicit imports of local code. If you want, provide the api_client code or its credential model and I can re-evaluate with higher confidence.

Type: OpenClaw Skill Name: retail-clerk-performance-analysis Version: 1.0.0 The skill bundle is classified as suspicious due to several security vulnerabilities found in analyze.py. Specifically, the script contains a hardcoded absolute path to a developer's home directory (/Users/yangguangwei/.openclaw/workspace-front-door), which results in information disclosure and potential path hijacking. Additionally, the script lacks input sanitization for user-controlled parameters such as guide_name and store_id before passing them to internal API endpoints, which could allow for injection attacks if the backend services are not properly secured.