← 返回 Skills 市场
danielfoch

IDX CMA Report

作者 danielfoch · GitHub ↗ · v0.1.0
cross-platform ⚠ suspicious
768
总下载
0
收藏
1
当前安装
1
版本数
在 OpenClaw 中安装
/install idx-cma-report
功能描述
Generate comparative market analysis (CMA) and home valuation reports from IDX listing data and selected comparable properties. Use when a user wants to pick...
使用说明 (SKILL.md)

IDX CMA Report

Use this skill to turn subject-property data and IDX comparables into a defensible CMA package with:

  • Structured valuation calculations
  • A written report for agent/client review
  • An interactive handoff prompt for Google Gemini Canvas / Google AI Studio

Workflow

1. Gather Data Through IDX MCP/CLI

Use the IDX MCP/CLI skill already available in the environment to pull:

  • Subject property details
  • Candidate comparable listings (closed/pending/active based on user preference)

Ask the user which comps to include when the choice is ambiguous. Keep 3 to 8 comps unless the user requests otherwise.

Normalize data to JSON using the schema in references/cma-input-schema.md.

2. Build CMA Outputs

Run:

python3 scripts/build_cma.py \
  --subject subject.json \
  --comps comps.json \
  --output-dir cma-output

The script produces:

  • cma-output/cma_report.md (summary report)
  • cma-output/cma_data.json (calculation payload)
  • cma-output/interactive_local.html (local interactive view)
  • cma-output/gemini_canvas_prompt.md (prompt for Google tools)

3. Review and Explain Adjustments

Before final delivery:

  • Show the comp set used
  • Show estimated range and central estimate
  • Explain assumptions and major adjustments in plain language
  • Flag missing/low-quality fields that weaken confidence

Use references/valuation-guidelines.md for adjustment defaults and confidence guidance.

4. Publish Interactive Version in Gemini

Use cma-output/gemini_canvas_prompt.md as the base prompt. Then:

  1. Open Google AI Studio or Gemini Canvas.
  2. Paste the generated prompt and provide cma_data.json.
  3. Ask for an interactive CMA web app with:
    • Comp table with sorting/filtering
    • Map-ready data fields (if lat/lng present)
    • Value-range visualization
    • Notes panel explaining adjustments
  4. Request hosted/shareable output if available in the chosen Google tool.

See references/gemini-canvas-publish.md for a copy-ready checklist.

Safety Rules

  • Treat outputs as broker/agent CMA support, not a licensed appraisal.
  • Surface data gaps, outliers, or stale comps before presenting a valuation.
  • Never invent listing attributes; mark missing values as unknown.
  • Keep a clear boundary between factual listing data and model assumptions.

References

  • references/cma-input-schema.md
  • references/valuation-guidelines.md
  • references/gemini-canvas-publish.md
安全使用建议
This package appears to be a straightforward, local CMA generator, but please consider the following before use: 1) Inspect the included scripts/build_cma.py locally and run on sample data in a safe environment — it is pure Python and uses only the standard library, but you should still review code before execution. 2) The skill expects you to use an existing IDX MCP/CLI to fetch listings; that tool will likely require MLS/IDX credentials — verify you trust that tool and comply with MLS/IDX data-sharing rules. 3) The generated Gemini/AI Studio prompt may contain property data; when you paste data into Google AI Studio/Gemini Canvas you are intentionally sharing that data with Google — ensure you have permission to share client/MLS data. 4) Note the gemini prompt in the script appears truncated; confirm the prompt text is complete for your publishing needs. 5) Always validate automated valuations before presenting to clients (the skill itself includes disclaimers). If you want extra assurance, run the script in an isolated environment and test the outputs against known examples.
功能分析
Type: OpenClaw Skill Name: idx-cma-report Version: 0.1.0 The skill is classified as suspicious due to critical vulnerabilities in `scripts/build_cma.py`. Specifically, the `_build_interactive_html` function directly embeds user-controlled JSON data into a `<script>` tag in the generated `interactive_local.html` without proper HTML escaping, leading to a Cross-Site Scripting (XSS) vulnerability. A malicious user could inject arbitrary JavaScript via fields like 'address' in the input JSON. Additionally, there's a potential arbitrary file write vulnerability if the AI agent can be prompted to modify the `--output-dir` argument of the `build_cma.py` script to a sensitive system path, allowing files to be written to unauthorized locations.
能力评估
Purpose & Capability
Name/description match the included assets: a local script (scripts/build_cma.py), input schema, valuation guidelines, and publishing checklist. The skill asks the user/agent to obtain listings via an existing IDX MCP/CLI skill — this dependency is coherent for IDX-based CMAs. No unrelated credentials, binaries, or config paths are requested.
Instruction Scope
Runtime instructions stay within the CMA workflow: collect subject and comps (via IDX MCP/CLI), normalize to the provided schema, run the local Python script to produce report, and manually publish to Google AI Studio/Gemini Canvas by pasting the generated prompt and attaching cma_data.json. One minor oddity: the gemini prompt embedded in scripts/build_cma.py appears truncated in the distributed file ('…[truncated]'), which could mean the full prompt text is incomplete — that’s sloppy but not malicious. Instructions do not tell the agent to read unrelated files or to transmit data automatically to external endpoints.
Install Mechanism
There is no install spec (instruction-only skill with a bundled script). The Python script is pure standard-library code and does not attempt to download or execute external artifacts. No archive downloads, package installs, or third‑party registries are used.
Credentials
The skill declares no required environment variables, no credentials, and no config paths. Note: the workflow expects an external IDX MCP/CLI skill to fetch listings — that other skill may require MLS/IDX credentials, which is reasonable and external to this package.
Persistence & Privilege
The skill does not request persistent presence (always:false) and contains no code to modify agent/system configurations. Autonomous invocation is allowed by platform default but the skill itself does not request elevated or persistent privileges.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install idx-cma-report
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /idx-cma-report 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v0.1.0
idx-cma-report 0.1.0 — Initial release - Generates comparative market analysis (CMA) and home valuation reports using IDX listing data and chosen comparables. - Provides structured valuations, written agent/client reports, and prompts for interactive experience in Google AI Studio or Gemini Canvas. - Guides users through comp selection, data normalization, and CMA output creation. - Flags data gaps, explains adjustments, and ensures transparency between data and modeling. - Designed for agent/broker support; not a licensed appraisal tool.
元数据
Slug idx-cma-report
版本 0.1.0
许可证
累计安装 1
当前安装数 1
历史版本数 1
常见问题

IDX CMA Report 是什么?

Generate comparative market analysis (CMA) and home valuation reports from IDX listing data and selected comparable properties. Use when a user wants to pick... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 768 次。

如何安装 IDX CMA Report?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install idx-cma-report」即可一键安装,无需额外配置。

IDX CMA Report 是免费的吗?

是的,IDX CMA Report 完全免费(开源免费),可自由下载、安装和使用。

IDX CMA Report 支持哪些平台?

IDX CMA Report 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 IDX CMA Report?

由 danielfoch(@danielfoch)开发并维护,当前版本 v0.1.0。

💬 留言讨论