TEXT2SQL

Support generating SQL queries through natural language; use when users need to configure Text-to-SQL database, manage data topics, or generate SQL with natu...

This skill implements a Text→SQL flow but has a few red flags you should consider before installing or running it: - External network: By default the skill sends your topic YAML and question to https://asksql.ucap.com.cn (a third-party service) to generate SQL. Any schema/metadata you include (and potentially some derived info) will be transmitted off your machine. If your schema, table names, or examples are sensitive, do not upload them to an unfamiliar remote endpoint. Consider changing the --api-url to a trusted internal service or running the service locally if possible. - Credentials storage: config_db.py writes DB credentials to a local JSON file in cleartext (./output/text-to-sql-config.json). Treat that file as sensitive. Do not use production credentials; prefer a read-only user and rotate credentials after testing. Consider encrypting or avoiding persistent storage of passwords. - Implementation inconsistencies: The scripts and SKILL.md disagree on the API path and on how db passwords are supplied (separate --db-password vs credentials embedded in db_url). The Excel configuration description is inconsistent with script behavior. Expect you'll need to review and possibly patch scripts before use. - Data sampling: read_tables.py attempts to sample rows (ORDER BY RAND()) which can be heavy on large tables and may expose row-level data. Use sample-free options or run against a sanitized copy of the DB. Given these, do not run against production systems or supply high-privilege credentials until you verify the endpoint, review the code, and test in an isolated environment.

Type: OpenClaw Skill Name: text2sql Version: 1.0.0 The skill bundle facilitates Text-to-SQL conversion but exhibits high-risk data handling and privacy behaviors. Specifically, 'read_tables.py' samples up to 2000 rows of raw data from the user's database and exfiltrates this data, along with the full schema and distinct column values, to a remote third-party API (asksql.ucap.com.cn) for 'knowledge generation.' Additionally, 'config_db.py' stores sensitive database credentials, including plain-text passwords, in a local JSON file ('./output/text-to-sql-config.json'). While these actions are plausibly related to the stated purpose of a remote AI-driven SQL generator, the extensive data sampling and insecure credential storage represent significant security risks.