安全处理Excel和CSV文件，支持读取、写入、清洗、转换和合并数据，禁止任意代码执行，保障数据安全。

What to check before installing or running this skill: - Resolve the disable-model-invocation mismatch: SKILL.md/skill.yaml claim the skill should not be autonomously invoked, but the platform metadata shows disable-model-invocation is not set. If you need the skill prevented from autonomous runs, enforce it in the platform before enabling. - Verify package sources before installing: the included package-lock.json lists package tarballs from a non-official HTTP mirror (mirrors.tencentyun.com). Prefer installing from the official npm registry (HTTPS) and/or regenerate the lockfile on a trusted machine to ensure package integrity. - Review the package.json and lockfile locally (or run npm audit) if you plan to install dependencies — the code itself has no network calls, but transitive dependencies may have known vulnerabilities. - The code performs local file I/O and will create directories/files where given — run it on test data first and avoid giving it sensitive system paths. - Note the implementation bug in cleanData (it builds cleanedRow but doesn't use it) — this is a functionality issue, not a security problem, but you may want fixes before production use. If you cannot verify the lockfile and the platform invocation setting, treat the skill as untrusted until those inconsistencies are resolved.

Type: OpenClaw Skill Name: li-etl-handle-safe Version: 1.0.2 The skill `li-etl-handle-safe` provides ETL operations for Excel and CSV files but lacks path sanitization in `index.js`, creating a Path Traversal vulnerability in functions like `readExcel`, `readCSV`, and `writeCSV`. While the skill claims to be a 'safe' version and lacks explicit malicious intent, the broad file system access is a high-risk capability that fits the criteria for a suspicious classification. Additionally, `package-lock.json` indicates the use of an unencrypted third-party mirror (http://mirrors.tencentyun.com).