Unit Price Database Manager

Manage construction unit price databases: update prices, track vendors, apply location factors, maintain historical records. Essential for accurate estimating.

This skill appears coherent and focused on managing unit-price data. Before installing, note that it declares filesystem permission (needed for importing/exporting local databases) — only grant it access if you trust it to read/write the directories where you store data. There are no network endpoints or credentials requested. If you plan to run the included Python examples locally, review them and any dependencies (pandas, Decimal usage) before execution. If you need stricter limits, avoid giving it access to sensitive folders or run it in an isolated environment.

Type: OpenClaw Skill Name: unit-price-database-manager Version: 2.0.0 The skill is classified as suspicious due to its direct and unrestricted file system read/write capabilities via `import_from_csv` and `export_to_csv` methods in `SKILL.md`. While the `claw.json` explicitly declares `filesystem` permission, these functions accept arbitrary `file_path` arguments, creating a significant Local File Inclusion/Arbitrary File Write vulnerability. A malicious prompt could instruct the AI agent to read sensitive system files (e.g., `/etc/passwd`, `~/.ssh`) or overwrite critical files, leading to data exfiltration or denial of service. There is no evidence of intentional malicious behavior within the code or instructions, but the high-risk nature of this vulnerability warrants a 'suspicious' classification.