sql-reports

Connects to SQL Server to retrieve and generate monthly, quarterly, and yearly delivery order reports with performance comparisons and growth metrics.

Do not run this skill against your environment without review. Specific concerns: (1) query.py contains plaintext DB credentials and a hard-coded server — treat these as sensitive and potentially invalid or stale; (2) SKILL.md and the code disagree on the database name and available queries, so functionality may be incomplete or incorrect; (3) running the script will print database rows (possibly sensitive PII/product data) to stdout. Before installing: ask the publisher for the correct architecture and for removal of embedded credentials; require credentials be provided via secure environment variables or a secrets store and documented in the skill metadata; validate the queries and least-privilege DB account; run any untrusted code in an isolated environment and audit network destinations. If these fixes are not made, consider the skill unsafe to use.

Type: OpenClaw Skill Name: sql-reports Version: 1.0.0 The skill contains hardcoded database credentials (UID: 'ptcl-bot', PWD: 'ptcl-bot123') and targets a specific internal network server ('LTEDP056') in query.py. While the script appears to perform its stated function of generating delivery reports and uses parameterized queries to mitigate SQL injection, the inclusion of plaintext credentials and internal network targets represents a significant security risk and poor practice.