sql-doc

通过数据库API查询表数据，对指定数据进行分析并生成包含多维度信息的Word格式分析报告。

This skill is internally inconsistent: SKILL.md tells you to curl an internal API and then run a Python script, but the provided analyze_data.py only uses a hard-coded sample dataset (it doesn't read the curl output). Before installing or running, verify these points: 1) Confirm you intended to contact the internal endpoint 192.168.5.85:8000 and that doing so is allowed and safe — the skill's examples reference police incident data which may be sensitive or regulated. 2) The script requires python-docx but no install steps are provided; run in an environment with required Python packages or update the skill to declare/install dependencies. 3) Decide how API results should be passed to the script (save curl output to a file and modify the script to read it, or update the script to call the API itself). 4) Because the code and instructions don't match, inspect and test the skill in an isolated environment before using on real data; review/modify the SQL examples to avoid accidental exfiltration of sensitive records. If you need this to actually query and process live API results, ask the maintainer (or modify the script) so the script reads JSON output from the API rather than using embedded sample data.

Type: OpenClaw Skill Name: sql-doc Version: 1.0.1 The skill bundle facilitates raw SQL execution via curl commands to an internal IP (192.168.5.85), which presents a significant security risk for unauthorized data access or manipulation. Additionally, the analyze_data.py script contains hardcoded sensitive information, including what appear to be Chinese citizen ID numbers and records of domestic disputes, raising privacy and data handling concerns. While no clear evidence of intentional data exfiltration to external domains was found, the combination of raw SQL capabilities and the processing of PII makes this bundle high-risk.