Generate narrative budget justifications for NIH/NSF applications

This skill appears to do what it says at a high level, but there are important inconsistencies and missing safety checks you should address before using it: - Mismatch: SKILL.md documents CLI flags (e.g., --input/-i, --format, --agency) that the shipped script does not implement; the script only provides --demo and help text for --personnel/--equipment but never actually reads those files. Expect the feature set to be incomplete or broken. - Missing input parsing: The script does not parse JSON/CSV inputs even though the skill claims to accept them. If you need real input-file processing, request the author to implement and test JSON/CSV parsing. - Path safety: The script writes the output file directly with open(args.output, 'w') and does not validate the output path. This could allow writing outside the intended workspace (e.g., using ../). Ask for checks ensuring the output file resides in a workspace-restricted directory (use absolute path checks or a sandbox) and refuse unsafe paths. - Error handling & sanitization: The script prints messages and writes files but lacks robust error handling for malformed inputs. Request improved validation, sanitized error messages, and unit tests for edge cases. - Run in a sandbox first: Until the code is corrected, run it in an isolated environment where file writes cannot overwrite sensitive system files. Recommended action: do not install/enable this skill for production use until the author updates the code to implement the declared CLI options, adds JSON/CSV parsing with validation, enforces output-path confinement to the workspace, and provides tests or updated documentation verifying the behavior.

Type: OpenClaw Skill Name: grant-budget-justification Version: 0.1.1 The skill bundle is a legitimate tool designed to generate narrative budget justifications for grant applications. The Python script (scripts/main.py) performs basic string formatting and arithmetic to calculate costs for personnel, equipment, and travel, while the documentation (SKILL.md) accurately describes the tool's intended use without any malicious instructions or prompt injection attempts.