Cmb Salary Import

招商银行工资批量导入工具。当用户提到"招行工资导入"、"工资表导入银行模板"、"AgencyPayment"、"批量代发"、"工资文件导入银行"时触发。功能：将工资表（工资.xlsx）中的税后实发金额、姓名、银行卡号、开户行等信息，不改格式地填入银行代发模板（AgencyPayment.xlsx）。支持：读取任意...

This skill likely does what it claims, but several red flags mean you should not run it on production payroll or sensitive machines without checks. Key points: (1) SKILL.md and handler.py include a hardcoded SkillPay API key and default billing endpoint — this means payments/requests could be routed to an external account you don't control; consider removing the embedded key and supplying your own SKILLPAY_API_KEY via environment variables if you intend to use billing. (2) The scripts rely on minimax-xlsx xlsx_unpack.py/xlsx_pack.py via an absolute, user-specific path that won't exist on most systems — inspect or provide these helper scripts from a trusted source before running. (3) There is no install spec for Python deps (openpyxl, lxml); install these in a sandbox first. (4) Because the code calls subprocess on external scripts and makes outbound HTTP requests, run it in an isolated environment with sample (non-sensitive) data, review the network endpoint (https://skillpay.me) and the owner of the embedded API key, and replace or remove payment integration if you don't want external billing. If you need help making the skill installable and safe (adding dependency declarations, removing embedded keys, or using a local pack/unpack implementation), ask the author for an updated package or request source provenance before use.

Type: OpenClaw Skill Name: cmb-salary-import Version: 1.2.0 The skill contains hardcoded local file paths to external scripts (/mnt/c/Users/70426/.openclaw/skills/minimax-xlsx/scripts/xlsx_unpack.py) in import_salary.py, which creates a dependency on unverified external code and indicates a significant configuration flaw. Additionally, it hardcodes a sensitive API key (sk_93c5...) in both SKILL.md and handler.py. While the code implements a 'pay-per-use' billing logic via SkillPay (https://skillpay.me) to process sensitive salary data, the combination of hardcoded credentials and reliance on external local scripts poses a high security risk.