历史基线分析

门店历史基线分析工具。基于Agent API数据库视图，提供多周期基线+四分位分析。 核心能力： 1. 多周期基线（13周/季度、26周/半年、52周/全年、12个月） 2. 多维度分组（按星期几分组、自然周、自然月） 3. 四分位分析（P25/P50/P75，识别异常区间） 4. 基线类型（weekday按星期...

This skill appears to implement the baseline analysis it advertises, but there are red flags you should address before installing or running it in production: - The code inserts a hard-coded absolute path (/Users/yangguangwei/...) into sys.path and imports api_client from there. Ask the publisher why this external module is required and request that api_client be bundled, replaced with a documented dependency, or imported via a relative path. Running the skill as-is could cause it to execute code outside the skill bundle if that path exists in your environment. - query_database is called but not defined in the skill; confirm what api_client.query_database does, what credentials it uses, and whether it can access more data than intended. Prefer explicit, documented dependencies or an SDK instead of implicit imports. - The SQL strings are built via f-strings with interpolated store_id/dates. If you or callers can pass untrusted input into store_id, this could produce unexpected SQL. Validate or sanitize inputs if you accept external values. - Some data-fetching functions (weekly/monthly) appear unimplemented/return empty lists; test the skill with non-production data and review outputs for correctness. If you cannot get satisfactory answers about the api_client dependency and the hard-coded path, treat the skill as risky and avoid running it in environments where that path could contain attacker-controlled code or where query_database has broad DB privileges.

Type: OpenClaw Skill Name: retail-store-poscore-baseline-analysis Version: 1.0.0 The skill performs retail store performance baseline analysis but contains potential SQL injection vulnerabilities in analyze.py (e.g., fetch_daily_data, fetch_weekly_data) where user-provided parameters like store_id and dates are inserted directly into SQL queries using f-strings. It also relies on a hardcoded local file path (/Users/yangguangwei/...) to import its database client, which is a poor practice but not inherently malicious.