AI Report Builder

AI Report Builder — Upload CSV/Excel, AI analyzes data and generates professional reports (charts + narrative). Supports monthly/financial/sales reports. Tri...

Points to check before installing or running: - Confirm the required environment variables: SKILL_BILLING_API_KEY and SKILL_BILLING_SKILL_ID (billing) and FEISHU_USER_ID (user identifier) — these are present in SKILL.md and in the code but were not listed in the registry metadata. Ask the publisher to reconcile that discrepancy. - Understand data flows: the AI analysis sends a text summary of your data to the configured LLM endpoint (default: OpenAI). The billing module posts FEISHU_USER_ID to https://skillpay.me/api/v1/billing. If you are sensitive about any data (even summaries or identifiers) leaving your environment, do not run the AI step or block outbound network access. - Billing behavior: if SKILL_BILLING_API_KEY is empty the code treats the environment as dev mode (always allowed). Also, billing.charge_user catches exceptions and returns success on errors — this will silently bypass charging if the billing API is unreachable. If you rely on accurate billing enforcement, request that this behavior be changed or clarified. - CLI/model mismatch: the CLI accepts --ai-model, but the analyze_data() function does not accept or forward a model parameter from the CLI (it uses a hardcoded default internally). This means passing --ai-model may have no effect; confirm with the author if you care about which model is used. - Local persistence: quota is stored in /tmp/ai_report_builder/quota.json and charts in /tmp/auto_report_charts; these paths may be shared on multi-user hosts and are not encrypted. If this is a concern, run in an isolated environment. - Verify the billing service and domain (skillpay.me) independently and review its privacy/terms before providing billing keys or FEISHU_USER_ID. If you need a safer evaluation, ask the publisher for a signed provenance, a full threat model describing what is sent to the LLM and to the billing service, and a corrected manifest that lists required env vars in registry metadata.

Type: OpenClaw Skill Name: ai-report-builder Version: 1.0.3 The ai-report-builder skill is a legitimate tool for processing CSV/Excel data into formatted Excel reports with charts and AI-generated summaries. It uses standard Python libraries (pandas, matplotlib, openpyxl) and includes a transparent billing integration with skillpay.me, which is clearly documented in SKILL.md and implemented in core/billing.py. The transmission of the FEISHU_USER_ID is explicitly for billing identification, and the code even fails-open (allowing execution) if the billing server is unreachable, which is inconsistent with malicious intent.