Data Analysis Assistant — 技能工具
v1.0.6AI-powered data analysis using EvoLink API. Decision-first methodology with statistical rigor. Powered by evolink.ai
0· 282·0 当前·0 累计
by @evolinkai 安全扫描
OpenClaw
安全
high confidenceThe skill behaves as described — it reads a local CSV/JSON/Excel file and sends the file contents to api.evolink.ai for analysis using an EvoLink API key — there are minor metadata inconsistencies but no signs of hidden or unrelated functionality.
评估建议
This skill will send the entire contents of any input data file to api.evolink.ai; do not use it on files that contain PII, credentials, or confidential business data. Before using: (1) review the included scripts yourself (they are readable and use curl/jq/python3/file), (2) ensure files you analyze are placed under the configured safe directory and sanitized of secrets, (3) set EVOLINK_API_KEY only if you trust the EvoLink service and consider using a scoped/revocable key, (4) note the registr...详细分析 ▾
✓ 用途与能力
The skill's name/description (data analysis via EvoLink) aligns with what the code does: the script reads a data file and posts its contents to https://api.evolink.ai for analysis. The required credential (EVOLINK_API_KEY) and declared helper binaries (curl, jq, python3, file) are consistent with that purpose. Note: the top-level registry summary provided with the evaluation incorrectly listed no required env vars/credentials, while the included SKILL.md and _meta.json do declare EVOLINK_API_KEY and related env vars — this is an inconsistency in the registry metadata but not evidence of malicious behavior.
ℹ 指令范围
The script deliberately reads the entire file and includes its full contents in the API request (this is the intended behavior and is clearly documented and warned about in SKILL.md). The skill includes several protective checks (safe directory constraint, symlink rejection, filename blacklist, 50MB size limit, MIME/extension checks). These protections reduce risk but do not eliminate the primary privacy concern: any sensitive data present in the file (credentials, PII, confidential business data) will be transmitted to the external EvoLink API. The README and SKILL.md explicitly warn about this.
✓ 安装机制
No install spec — instruction-only with an included shell script. Nothing is downloaded or written beyond running the provided script with standard system tools. This is low-risk from an install/remote-code-fetch perspective.
✓ 凭证需求
The only required secret is EVOLINK_API_KEY (plus optional EVOLINK_MODEL and DATA_ANALYSIS_SAFE_DIR), which is proportional to a service that requires authentication. The script sends the API key in the Authorization header to api.evolink.ai as expected. The only discrepancy is the registry summary earlier in the package metadata (which claimed no required env vars) — a documentation/manifest mismatch that should be corrected but does not change the proportionality of requested credentials.
✓ 持久化与权限
The skill does not request always:true, does not modify other skills or system settings, and does not request elevated or persistent permissions. It operates at runtime only when invoked.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
安装命令
点击复制官方npx clawhub@latest install evolink-data-analysis
镜像加速npx clawhub@latest install evolink-data-analysis --registry https://cn.longxiaskill.com 镜像可用
本土化适配说明
Data Analysis Assistant — 技能工具 安装说明： 安装命令：["openclaw skills install evolink-data-analysis","npx clawhub@latest install evolink-data-analysis"] 该技能用于支付宝相关操作，可能需要相应的平台账号或API密钥