门店Benchmark分析

门店Benchmark分析工具。与集团/区域其他门店对比，分析门店等级、排名变化、件单价×连带率矩阵象限。 核心能力： 1. 多维度对比范围（集团全部、区域、省份、城市） 2. 门店等级评估（基于销售额、订单数、客单价、连带率） 3. 排名变化追踪（本期排名vs上期排名） 4. 件单价×连带率矩阵象限分析（识别门...

Do not install or run this skill until the author clarifies and fixes the inconsistencies. Specific issues to resolve: 1) The SKILL.md example calls analyze_benchmark but the code function is analyze — fix the docs or code. 2) Remove or explain the hard-coded sys.path insertion ('/Users/yangguangwei/...') — this ties the skill to a specific user's workspace and hides dependencies; the skill should import public modules or document required local modules and config paths. 3) Declare any database/API credentials or config required (host, user, password, tokens). Right now no env vars are declared yet the code calls query_database, which could access sensitive data. 4) Prevent SQL injection: avoid concatenating user inputs (scope_code, dates) directly into SQL; use parameterized queries or validate/sanitize inputs. 5) Ask the author to provide the implementation or provenance of api_client.query_database (what DB, where it connects, who can access it). Until these are addressed, treat the skill as suspicious and run it only in an isolated environment after reviewing or replacing api_client with a known-safe connector.

Type: OpenClaw Skill Name: retail-store-benchmark-analysis Version: 1.0.0 The skill contains a critical SQL injection vulnerability in `analyze.py` within the `fetch_stores_performance` function, where parameters such as `scope_code`, `from_date`, and `to_date` are directly interpolated into SQL strings using f-strings. Additionally, the script includes a hardcoded absolute path to a specific user's home directory (`/Users/yangguangwei/`) to import local modules, which is a significant security risk and portability flaw. While these are high-risk vulnerabilities, they appear to be unintentional coding errors rather than intentional malware.