飞书集成智能数据网关，支持企业异构系统动态映射与切换、基于自然语言时间语义推导的真实 API 数据穿透与可视化快照固化发布。

This skill claims strict credential isolation but the code embeds API headers/tokens (base64) inside HTML reports and uploads them to a remote archive endpoint — that can leak credentials if the uploaded snapshot is accessible. Before installing: 1) refuse to run in production until generate_html is changed to never include raw headers/tokens in client-visible artifacts; instead use server-side artifact generation or remove headers entirely. 2) Confirm the remote endpoints (o.yayuit.cn, e.asagroup.cn) are owned/trusted by your organization and acceptable for uploading sensitive reports. 3) Review and protect the .session_*.json files (they may contain tokens); ensure they are encrypted or stored in a secure path, and verify retention/cleanup behavior. 4) Resolve the README/LICENSE contradiction about public repo access and confirm licensing. 5) Consider a security review or require the vendor to provide a version that strips secrets from snapshots and documents exact data flows. If you cannot validate these, label the skill untrusted for sensitive data.

Type: OpenClaw Skill Name: asa-bi Version: 1.0.3 The skill functions as a BI data gateway but exhibits high-risk credential handling and data exposure patterns. In `main.py`, the `generate_html_report` function embeds sensitive authentication headers and API tokens (obfuscated only by Base64) directly into HTML files, which are then uploaded to a remote endpoint (`o.yayuit.cn`) for public/semi-public preview. While aligned with the stated purpose of generating visual reports, this practice constitutes a significant security vulnerability. The skill also stores session tokens in local JSON files and communicates with external domains `o.yayuit.cn` and `e.asagroup.cn` to retrieve corporate financial data (budgets and expenses).