← Back to Skills Marketplace
sql-reports
by
kyawzo-ptcl
· GitHub ↗
· v1.0.0
· MIT-0
273
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install sql-reports
Description
Connects to SQL Server to retrieve and generate monthly, quarterly, and yearly delivery order reports with performance comparisons and growth metrics.
Usage Guidance
Do not run this skill against your environment without review. Specific concerns: (1) query.py contains plaintext DB credentials and a hard-coded server — treat these as sensitive and potentially invalid or stale; (2) SKILL.md and the code disagree on the database name and available queries, so functionality may be incomplete or incorrect; (3) running the script will print database rows (possibly sensitive PII/product data) to stdout. Before installing: ask the publisher for the correct architecture and for removal of embedded credentials; require credentials be provided via secure environment variables or a secrets store and documented in the skill metadata; validate the queries and least-privilege DB account; run any untrusted code in an isolated environment and audit network destinations. If these fixes are not made, consider the skill unsafe to use.
Capability Analysis
Type: OpenClaw Skill
Name: sql-reports
Version: 1.0.0
The skill contains hardcoded database credentials (UID: 'ptcl-bot', PWD: 'ptcl-bot123') and targets a specific internal network server ('LTEDP056') in query.py. While the script appears to perform its stated function of generating delivery reports and uses parameterized queries to mitigate SQL injection, the inclusion of plaintext credentials and internal network targets represents a significant security risk and poor practice.
Capability Assessment
Purpose & Capability
The skill's stated purpose (generate monthly/quarterly/yearly delivery reports) matches the presence of SQL query code, but there are inconsistencies: SKILL.md names the Database as 'DeliveryDB' while query.py uses 'PDFExtraction'; SKILL.md documents queries like 'monthly_comparison' and 'quarterly_report' that are not implemented in query.py. The core capability (querying SQL Server) is coherent but the documentation and implementation disagree.
Instruction Scope
SKILL.md tells the agent to connect to LTEDP056\SQLEXPRESS and install ODBC/pyodbc, which is appropriate for a SQL-reporting skill. However, SKILL.md does not mention credentials, while query.py contains a hard-coded connection string (server, DB, UID, PWD) and will print full query results to stdout. The instructions do not declare or constrain use of these embedded credentials or the sensitivity of the returned data.
Install Mechanism
No install specification is provided; this is an instruction+code skill that relies on Python and pyodbc. That is a low install risk (nothing is downloaded/installed by the skill itself).
Credentials
The code contains plaintext DB credentials (UID=ptcl-bot; PWD=ptcl-bot123) and a hard-coded server name, yet the skill declares no required environment variables or primary credential. Requesting/including credentials in the code (instead of using declared/env-provided secrets) is disproportionate and insecure. The skill also requires network access to an internal host, which is not explicitly represented in metadata.
Persistence & Privilege
The skill is not always-enabled and does not request persistent system-wide privileges or modify other skills. Execution simply runs query.py and yields outputs; autonomous invocation is allowed by platform default but is not combined here with elevated privileges.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install sql-reports - After installation, invoke the skill by name or use
/sql-reports - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
- Initial release of SQL Reports skill.
- Connects to SQL Server (DeliveryDB) to extract and analyze delivery order data.
- Offers prebuilt queries: monthly summary, month-to-month comparison, quarterly report, and yearly summary.
- Designed for warehouse managers and logistics teams; requires no manual SQL writing.
- Command-line interface with straightforward usage instructions.
Metadata
Frequently Asked Questions
What is sql-reports?
Connects to SQL Server to retrieve and generate monthly, quarterly, and yearly delivery order reports with performance comparisons and growth metrics. It is an AI Agent Skill for Claude Code / OpenClaw, with 273 downloads so far.
How do I install sql-reports?
Run "/install sql-reports" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is sql-reports free?
Yes, sql-reports is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does sql-reports support?
sql-reports is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created sql-reports?
It is built and maintained by kyawzo-ptcl (@kyawzo-ptcl); the current version is v1.0.0.
More Skills