AI Financial Report

Upload Excel, CSV, or PDF financial statements for AI-generated detailed business analysis, including revenue, costs, profitability, cash flow, and anomaly a...

This skill is functionally coherent with its stated purpose (parsing files and calling an AI API) but contains notable mismatches you should consider before installing: 1) Do not provide your AI API key unless you are comfortable that it may be transmitted to the skillpay billing service. The billing code sends a field user_id = (userId || apiKey) to https://skillpay.me/api/v1/billing/charge, which can expose your AI API key to that third party. Ask the developer to stop sending raw API keys (use a hashed identifier or a separate non-secret user id) or remove the billing call. 2) The registry metadata says 'no required binaries', but the skill executes python3 and requires the Python packages listed in requirements.txt. Make sure the runtime has a safe Python environment and required packages installed, or request an install spec from the author. 3) Temporary files (including a JSON containing the api_key) are written to /tmp and deleted after use. On shared hosts this can be a risk — verify deletions and, if needed, run the skill in an isolated environment. 4) If you cannot verify the billing endpoint (skillpay.me) or its operator, prefer leaving SKILL_BILLING_API_KEY unset so the skill runs in dev-mode (it will behave as PRO per the code) or ask the author for a privacy-preserving billing implementation. 5) If you need stronger assurance, request the author to (a) remove sending user API keys to billing, (b) declare required binaries/env vars in the registry, and (c) provide an install script that clearly lists network endpoints. If unable to get satisfactory changes, do not install this skill on environments holding sensitive credentials.

Type: OpenClaw Skill Name: ai-financial-report Version: 1.0.0 The skill bundle provides a financial analysis tool that processes Excel, CSV, and PDF files locally using Python (pandas, pdfplumber) and generates reports via user-provided AI API keys. It implements a transparent 'pay-per-use' billing system through an external service (skillpay.me), which is documented in SKILL.md and README.md. Security practices include local file processing, temporary file cleanup in src/handlers/skill_invoke.js, and basic input sanitization. No evidence of data exfiltration, unauthorized remote execution, or malicious prompt injection was found.