Openclaw Research Viz

Generate interactive HTML research reports from AI research context. After completing a multi-step research task (web search, API calls, analysis), use this...

This skill is plausibly what it claims (generate, AES-encrypt, upload reports), but you should not install it blindly if you care about confidentiality. Before installing or running it with real data: 1) Inspect upload-report.js and worker/src/index.ts to confirm they do NOT transmit the plaintext or the AES key, and to see exactly which endpoint (a2ui.me URL) and headers are used; 2) Verify where the R2 storage is hosted and who controls a2ui.me — confirm retention, access controls, and deletion policy; 3) Look for hard-coded secrets or API keys in the repo (hard-coded credentials are a red flag); 4) If you cannot review the code, run the skill in an isolated, sandboxed environment with non-sensitive test data and observe network requests (does it only upload ciphertext? does it leak metadata?); 5) If you plan to enable autonomous invocation, consider the increased blast radius (the agent could upload many reports automatically). If any of the above checks are unclear or the upload code contains embedded credentials or sends unencrypted content/keys, consider not using the skill.

Type: OpenClaw Skill Name: research-visualizer Version: 1.5.0 The research-visualizer skill is a well-documented tool for generating and sharing interactive research reports. It features a sophisticated privacy-preserving architecture using AES-256-GCM client-side encryption, ensuring that decryption keys (stored in URL fragments) are never transmitted to the hosting server (a2ui.me or the fallback Cloudflare Worker at fcyaoquan.workers.dev). The code logic in scripts like generate-report.js and upload-report.js is transparent, lacks obfuscation, and strictly follows the stated purpose of visualizing research data without attempting to exfiltrate sensitive user credentials or system files.