Sfe Sxk Data Viewer

SFE深西康专属数据查询工具，用于快速查询深西康专属采集项目报表的数据，如新活素查房日采集反馈V2等特定项目的明细报表或汇总报表

Key things to consider before installing or using this skill: - The Python scripts do require an appKey (XG_BIZ_API_KEY or XG_APP_KEY) even though the skill metadata doesn't declare it — don't provide that secret until you've reviewed/trusted the code and the remote API. Consider running the scripts locally first and inspect network calls. - The request library in the script explicitly disables TLS verification (verify=False). This reduces security of the appKey and data in transit; ask the maintainer to remove verify=False or ensure you run in a trusted network. - SKILL.md tells the agent to install a dependency (cms-auth-skills) via npx or from a GitHub URL if missing. That means the agent may execute network installs of third-party code; review the cms-auth-skills project source before allowing any auto-install. - If you plan to grant the appKey, prefer running the provided scripts yourself in a controlled environment and inspect them for any exfiltration or unexpected endpoints. If you must use the skill hosted in an agent, only proceed if you trust the owner and the cms-auth-skills package, and consider rotating the appKey afterward. - If you have low tolerance for supply-chain risk, decline or request the author to (a) declare required env vars in metadata, (b) remove insecure TLS settings, and (c) vendor/declare the cms-auth-skills dependency explicitly rather than instructing runtime npx installs.

Type: OpenClaw Skill Name: sfe-sxk-data-viewer Version: 1.0.0 The skill bundle contains a security vulnerability and a potential supply chain risk. The script `scripts/sfe-sxk/xhs-ward-rounds-report-v2.py` explicitly disables SSL certificate verification (`verify=False`), which makes the connection to `erp-web.mediportal.com.cn` vulnerable to Man-in-the-Middle (MITM) attacks. Additionally, `SKILL.md` instructs the AI agent to execute `npx clawhub` to install a dependency from a specific external GitHub repository (`spzwin/cms-auth-skills.git`) if it is missing, which is a high-risk pattern for supply chain injection. While these appear to be operational choices rather than intentional malware, they exceed the threshold for benign classification.