📦 Client Dashboard — 客户KPI仪表板
v1.0.2基于QuickBooks Online数据自动生成面向客户的执行层KPI仪表板，输出带红绿灯评分与6个月趋势迷你图的Excel工作簿，一键洞察财务健康。
0· 188·1 当前·1 累计
by 下载技能包
最后更新
2026/4/21
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
Do not run this pipeline blindly. Before installing or invoking: 1) Ask the publisher to explain exactly how QBO authentication is provided (which env vars, config files, or system integrations are required). 2) Obtain and inspect the referenced script (scripts/pipelines/client-dashboard.py) to verify it does only the expected QBO API calls and file writes and does not exfiltrate data to unknown endpoints. 3) Check where CLIENT_CONFIGS and benchmarks are stored to ensure no secrets are hard-code...详细分析 ▾
⚠ 用途与能力
The skill's stated purpose is to connect to QuickBooks Online (QBO) and produce a KPI workbook, which legitimately requires QBO credentials or an authenticated client. The SKILL.md references 'Node.js qbo-client must be authenticated for the target slug' but the package requests no environment variables, primary credential, or config paths. That mismatch (a QBO-integrating pipeline that doesn't declare how authentication is provided) is unexplained and concerning.
ℹ 指令范围
The instructions are detailed and scoped to generating Excel reports, manipulating a local cache (.cache/client-dashboard/{slug}.json), and editing an in-script CLIENT_CONFIGS dictionary. They do not instruct reading unrelated system files or sending data to unexpected endpoints. However, they assume an authenticated 'qbo-client' and local script edits — the agent will run a Python pipeline that could access any files accessible to the agent, so you should inspect the pipeline code before running.
✓ 安装机制
This is an instruction-only skill with no install spec and no code files included in the package. That minimizes disk-write risk from the skill bundle itself (no remote downloads), but it does rely on external tooling (Python openpyxl and a Node qbo-client) which must already be present.
⚠ 凭证需求
No environment variables or credentials are declared even though QBO access is central to the skill. The SKILL.md expects the Node qbo-client to be 'authenticated' for the slug — it's unclear whether authentication is expected to live in environment variables, local config files, or a system-level credential store. This lack of declared credential requirements is a proportionality and transparency problem.
✓ 持久化与权限
The skill does not request persistent/always-on privileges (always: false). It writes a local cache under .cache/client-dashboard and expects output to a user directory (default ~/Desktop), which is reasonable for a reporting pipeline. Nothing indicates modification of other skills or global agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.22026/3/18
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install client-dashboard
镜像加速npx clawhub@latest install client-dashboard --registry https://cn.longxiaskill.com