专为调用本地数据接口并生成图表展示定制的 Skill。接收自然语言指令（如“我要最近一年燃油类型为天然气的扭矩占比”），自动提取参数，请求本地接口，生成 HTML 柱状图并返回完整的 HTML 源码。

Before installing or enabling this skill: - Understand it will execute a Python script that posts to http://127.0.0.1:9080 and returns whatever data the local API provides embedded in HTML. That can leak sensitive local data to whoever calls the skill. - The SKILL.md points at a hardcoded user path (/Users/laixufei/...) which likely won't exist; confirm how the agent will execute the included build_chart.py (adjust SKILL.md to a relative path if needed). - The code contains a hardcoded Bearer token. Treat that as a secret: ask the author to remove it and use a declared environment variable instead, or rotate the token and restrict its scope/permissions. Hardcoded credentials are a red flag. - The script sets requests.Session.trust_env = False, which avoids proxy interception — combined with the static token this looks intentional; verify the intended local API and trust boundaries. - Test the skill in a controlled environment (isolated VM/container) and review the exact data returned by the local API before enabling it for sensitive data or granting broad agent access. - If you cannot verify the origin or purpose of the embedded token and the author, treat the skill as untrusted and avoid running it against production/local services.

Type: OpenClaw Skill Name: local-api-chart-generator Version: 1.0.3 The skill contains hardcoded sensitive information, specifically a Bearer JWT token used for authentication in `build_chart.py`, and hardcoded absolute file paths (`/Users/laixufei/...`) in `SKILL.md`. While the code appears to perform its stated function of querying a local API (127.0.0.1:9080) for data visualization, the inclusion of specific user credentials and environment-specific paths is a significant security risk and highly irregular for a portable skill bundle.