Pans Excel

全功能智能 Excel 处理专家。功能：数据分析 | 图表可视化(7种) | 数据处理 | 报表模板(7种) | AI智能 | CSV/JSON导入导出 | 数据验证 | PDF导出 | 数据清洗。 触发词：Excel处理, 表格分析, 数据可视化, 图表制作, 公式生成, 报表生成, 销售看板, 财务分析, 对...

This skill largely looks like an offline Excel utility and the commands in SKILL.md match the code you can see, but the python file was truncated in the provided bundle and the skill advertises AI-powered analysis without listing any API keys or network requirements. Before installing or running: 1) review the complete scripts/excel.py for any network activity (imports like requests, urllib, socket, http, openai, or direct IP/URL strings) or subprocess/os.system calls; 2) search the code for reading environment variables or secrets it didn't declare; 3) run the tool in a sandbox or VM first and avoid running it on sensitive data until you're sure it only reads/writes the intended files; 4) if the analyze/insights feature requires an external AI service, confirm where it expects credentials and who controls that endpoint. If you want, provide the full excel.py (untruncated) and I can re-check specifically for hidden endpoints or exfiltration.

Type: OpenClaw Skill Name: pans-excel Version: 1.2.0 The skill bundle is classified as suspicious due to a critical Remote Code Execution (RCE) vulnerability in `scripts/excel.py`. The functions `load_data` and `ld` use `eval()` to parse the data argument (`-d/--data`) for several commands, allowing for the execution of arbitrary Python code. While the bundle's stated purpose of Excel processing and reporting appears legitimate and the `SKILL.md` instructions do not contain obvious prompt injections or malicious intent, the use of `eval()` on unsanitized input is a high-risk security flaw.