Pans Daily Sales Brief

AI算力销售每日简报生成器。自动汇总待跟进客户、到期合同、新线索和竞品动态。 维护客户pipeline数据，生成每日工作简报。 触发词：销售简报, 每日报告, 客户跟进, pipeline, 销售日报, daily brief, sales report

This skill mostly does what it says (reads a local pipeline.json and generates a brief), but there are unexpected behaviors you should verify before installing or running it: - Inspect the external writer: brief.py delegates file writes to a script at '~/Library/Application Support/QClaw/openclaw/config/skills/qclaw-text-file/scripts/write_file.py' and invokes '/opt/homebrew/bin/python3.11'. Open that write_file.py (and any scripts it calls) to confirm it only writes the provided JSON into pipeline.json and does not transmit or leak data elsewhere. - Check network calls: the script mentions using SearXNG / pansxng-websearch to fetch competitor news. Review the remainder of brief.py (the truncated section) for any HTTP requests or calls to remote endpoints, and verify which SearXNG instance is used. Ensure it does not post your pipeline data to external servers. - Assess platform assumptions: the hard-coded '/opt/homebrew/bin/python3.11' path is macOS/Homebrew-specific and may fail or invoke an unexpected interpreter on other hosts. Consider editing the script to use the current Python (sys.executable) or a portable approach. - Run in a sandbox first: before giving it access to real sales data, run the script in a restricted environment (different user account or VM) and observe network traffic and filesystem changes. - Ask the author: request clarification why the script uses an external QClaw helper to write files instead of writing directly, and ask for the full source of any referenced helper scripts and the missing portion of brief.py. If you cannot inspect the referenced helper or the rest of the script, treat the skill as risky for real customer/contract data because the external invocation is a plausible exfiltration vector.

Type: OpenClaw Skill Name: pans-daily-sales-brief Version: 1.0.0 The skill manages sales pipeline data but contains risky execution patterns in `scripts/brief.py`. It uses `subprocess.run` to execute scripts belonging to other skill bundles (`qclaw-text-file` and `pansxng-websearch`) using hardcoded absolute paths (e.g., `/opt/homebrew/bin/python3.11`). While this appears to be a mechanism for inter-skill communication and data persistence, the reliance on executing external binaries and scripts via shell-like calls is a high-risk behavior that could be leveraged for lateral movement or unauthorized execution if dependencies are compromised.