门店客流分析

门店客流与转化漏斗分析工具。基于AIoT客户行为数据（customerFunnel + behaviorFunnel）。 核心能力： 1. 双漏斗结合分析（customerFunnel客户分层 + behaviorFunnel试用行为） 2. 五步分析法（获取数据→解析customerFunnel→解析behav...

This skill appears to implement the documented analysis but has two issues you should verify before installing: 1) Hard-coded import path: analyze.py inserts '/Users/yangguangwei/.openclaw/workspace-front-door' into sys.path and imports api_client. That means the skill will load code from that local path if present. Verify who authored the api_client at that location and what it does. If you don't control or trust that path, the skill could execute arbitrary local code. 2) Undeclared credentials/config: The skill calls get_copilot_data(...) to fetch store data but doesn't declare required API host or authentication environment variables. Inspect api_client.get_copilot_data to see where it sends requests and which credentials it uses. Ensure it doesn't send data to unexpected endpoints or read secrets from your environment (e.g., ~/.aws, token files, or other local config). Recommended actions before use: - Open and review the api_client implementation that will be imported in your environment (or run the skill in an isolated sandbox where you control api_client). - Replace the hard-coded sys.path insertion with a documented import/install mechanism (or vendor a minimal, audited api client in the skill) and require explicit env vars for API host and token. - Run the skill in a restricted environment or with network monitoring to confirm it only calls the intended API endpoint and does not exfiltrate data. If you can provide the api_client source or confirm where get_copilot_data sends requests and how it's authenticated, I can reassess and raise or lower the concern level.

Type: OpenClaw Skill Name: retail-traffic-analysis Version: 1.0.0 The skill bundle provides a legitimate-looking retail traffic analysis tool, but contains a hardcoded absolute path to a specific user's directory (/Users/yangguangwei/.openclaw/workspace-front-door) in analyze.py. This is a security vulnerability (information leakage and potential path injection) and a sign of poor environment isolation. While the SKILL.md instructions and the logic in analyze.py appear focused on data processing without clear malicious intent like exfiltration or backdoors, the use of hardcoded local paths and manual sys.path manipulation is a high-risk practice in an agentic environment.