← 返回 Skills 市场

Flexible Data Importer

Name: Flexible Data Importer
Author: sschepis

作者 sschepis · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

1531

总下载

当前安装

版本数

在 OpenClaw 中安装

/install flexible-data-importer

功能描述

AI-powered ingestion of CSV, JSON, and XLSX files with auto schema generation and seamless Supabase database integration.

使用说明 (SKILL.md)

OpenClaw Data Importer Skill

\x3C!-- SKILL-META id: flexible-data-importer version: 1.0.0 author: OpenClaw description: AI-driven data ingestion for CSV, JSON, XLSX with auto-schema generation and Supabase integration. capabilities:

data-ingestion
schema-generation
supabase
etl requires: llm: true filesystem: true network: true invocation: cli: data-importer \x3Cfile-path> api: UniversalImporter.execute(filePath) parameters:
name: filePath type: string required: true description: Path to the source file (CSV, JSON, XLSX). -->

An AI-driven skill that ingests disparate data formats (CSV, JSON, XLSX) and builds a structured Supabase database. It automatically infers relationships, types, and schema names.

Inputs

filePath: String - Path to the source file.
supabaseUrl: String - Your project URL.
supabaseKey: String - Service role key for schema creation.

Capabilities

Auto-Schema: No need to define tables beforehand.
Type Safety: Automatically converts strings to dates/numbers where appropriate.
Batched Uploads: Handles large historical datasets without crashing.

安全使用建议

This skill appears to do what it claims (import files into Supabase using an LLM), but there are several inconsistencies and a real security implication: it expects a Supabase service_role key (full DB privileges) and possibly an OpenAI API key, yet the registry metadata does not declare those secrets. Before installing or using it: 1) Do not provide your production SUPABASE service_role key — create a least-privilege key or dedicated project for testing. 2) Ask the publisher for the full source (dist/cli.js, adapter implementations) to audit what data is read and where it is sent. 3) Prefer running the importer in a sandboxed environment with only the specific file(s) you intend to import. 4) Confirm how the skill handles sensitive fields (PII) and whether it transmits data to third parties beyond your Supabase project or the LLM provider. 5) If you cannot audit the code or limit credentials, treat this skill as untrusted and avoid giving high-privilege keys.

功能分析

Type: OpenClaw Skill Name: flexible-data-importer Version: 1.0.0 The skill is classified as suspicious due to its inherent high-risk capabilities, specifically requiring `network: true` and `filesystem: true` permissions, and explicitly handling sensitive credentials like `SUPABASE_KEY` and `OPENAI_API_KEY` as outlined in `SKILL.md` and `README.md`. While these capabilities are necessary for its stated purpose of AI-driven data ingestion into Supabase, the handling of API keys and network access always presents a potential attack surface. There is no clear evidence of intentional malicious behavior, prompt injection attempts, or unauthorized data exfiltration beyond the stated purpose.

能力评估

⚠ Purpose & Capability

SKILL.md and README describe a data-importer that uses an LLM and writes schemas to Supabase (auto-schema, upserts). That capability legitimately requires network, filesystem access, and a Supabase key. However, the registry header lists no required env vars or primary credential while the README/SKILL.md explicitly reference SUPABASE_URL, SUPABASE_KEY (service_role) and OPENAI_API_KEY. Also package.json indicates this is an npm package with a CLI (data-importer) but the bundle contains no source or dist files — inconsistent with the declared purpose.

⚠ Instruction Scope

Runtime instructions ask the agent to read an arbitrary file path (filePath) from the filesystem and upload and create schemas in a Supabase project. This scope is coherent with the importer purpose, but SKILL.md/README access environment variables and service keys that are not declared in the registry metadata. Reading arbitrary local paths plus networked upload is a sensitive combination: ensure the agent will only be given explicit file paths the user intends to import.

ℹ Install Mechanism

No install spec (instruction-only), which is lower risk. However, package.json and a large package-lock.json are present while no source or dist files are included in the bundle — this mismatch could indicate an incomplete package or omitted files. There's no download-from-URL or extract step in the manifest.

⚠ Credentials

The skill expects SUPABASE_URL and SUPABASE_KEY (explicitly a service role key in SKILL.md) and mentions OPENAI_API_KEY in README. A Supabase service_role key grants full database privileges (including schema changes and reading all data) and is high privilege; the registry metadata declares no required env vars or primary credential. Requesting such high-privilege credentials without declaring them is disproportionate and should be clarified. Prefer least-privilege credentials or require explicit user confirmation.

✓ Persistence & Privilege

always is false and there is no indication the skill requests permanent agent presence or modifies other skills' config. Autonomous invocation is allowed (platform default) but does not increase concern by itself.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install flexible-data-importer
安装完成后，直接呼叫该 Skill 的名称或使用 /flexible-data-importer 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial publish

元数据

Slug flexible-data-importer

版本 1.0.0

许可证 —

累计安装 1

当前安装数 1

历史版本数 1

常见问题