Agent Economy ReportAgent Economy ReportSAFE version 1.0.2 · audited 2026-09-17
This package is a set of Markdown reference guides for data analysis. It explains analytical methods, pitfalls, metric definitions, chart choice, and decision briefs. It contains no executable code, scripts, network requests, credential capture, payment code, or persistence mechanisms. The only command-like text is a set of `clawhub` CLI suggestions for installing related skills, starring the skill, or syncing updates; the install suggestion is conditioned on user confirmation. No hidden data exfiltration or rule-override instructions were found. The behavior matches the declared documentation purpose.
| Declared purpose | Data analysis and visualization: query databases, generate reports, automate spreadsheets, and turn raw data into clear, actionable insights (SKILL.md line 6). |
| Observed behavior | The package is a static collection of Markdown guides covering analytical methodology, pitfalls, chart selection, metric contracts, and decision briefs. It declares no external network requests and lists no endpoints (SKILL.md lines 129-137). There are no executable files, install scripts, hidden URLs, credential access, or payment mechanisms. The only command suggestions are `clawhub install` for related skills, `clawhub star`, and `clawhub sync` (SKILL.md lines 154-165). |
| Verdict, rules only | SAFE |
| Verdict, AI | SAFE |
| Final verdict | SAFE (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| filesystem_read | needed | The skill instructs the agent to load its own packaged Markdown guides: metric-contracts.md, chart-selection.md, decision-briefs.md, pitfalls.md, and techniques.md (SKILL.md lines 45-49 and 55-61). |
| network | exceeds purpose | No network behavior is present. SKILL.md line 131 says 'This skill makes no external network requests' and the endpoint table at line 135 is empty. The observed domains are only static homepage/publisher links. |
| shell | exceeds purpose | No executable shell calls are present. SKILL.md lines 155, 164, and 165 contain `clawhub` CLI instruction strings; skill-card.md line 45 lists shell commands as possible output, but no code executes them. |
| credentials | exceeds purpose | No credential capture, storage, or transmission is implemented. SKILL.md line 149 says it does not store credentials; skill-card.md lines 25-27 warn to keep user-supplied credentials local and avoid exposing them. |
| payments | exceeds purpose | No payment, wallet, or money-spending code is present in the package. |
| other | needed | The package is documentation-only. Its declared outputs include text, markdown, code, SQL, formulas, tables, chart guidance, and shell commands authored for the analysis task (skill-card.md line 45). |
| severity | finding |
|---|---|
| info | Declared purpose This frontmatter description defines the skill's intended purpose. It describes analysis and visualization tasks but does not itself execute them. SKILL.md:6 Data analysis and visualization. Query databases, generate reports, automate spreadsheets, and turn raw data into clear, actionable insights. |
| info | Declared homepage URL only The frontmatter declares a homepage link to clawic.com. No code uses this URL to make a network request. SKILL.md:5 homepage: https://clawic.com/skills/data-analysis |
| info | Publisher link A static link to the publisher profile on clawhub.ai; not fetched by the skill itself. skill-card.md:9 [ivangdavila](https://clawhub.ai/user/ivangdavila) |
| info | Local reference file access The skill asks the agent to read local Markdown guides included in the package. Filesystem read is limited to those named files. SKILL.md:45 Use the included reference files as lightweight guides: |
| info | No network behavior The skill explicitly states it makes no external network requests, consistent with the observed static Markdown files. SKILL.md:131 This skill makes no external network requests. |
| info | Empty endpoint table The endpoint table lists no endpoints and no data sent. SKILL.md:135 | None | None | N/A | |
| low | Command string for related skill install The file suggests installing four related skills using a CLI command. It is textual and conditioned on user confirmation; no automatic execution was found. SKILL.md:155 Install with `clawhub install <slug>` if user confirms: |
| low | Command string to star skill This line asks the agent or user to run a CLI command to star the skill. It is not part of data analysis and has no observed automatic execution. SKILL.md:164 - If useful: `clawhub star data-analysis` |
| low | Command string to sync This line asks the agent or user to run `clawhub sync`. It does not exfiltrate data, but it could trigger a package sync if followed. SKILL.md:165 - Stay updated: `clawhub sync` |
| info | No credential storage The skill's security section says it does not store credentials or raw exports in hidden local memory files. No code in the package does so. SKILL.md:149 - Store credentials or raw exports in hidden local memory files. |
| info | Credential awareness The skill card acknowledges that user-supplied analysis may involve sensitive data or credentials and tells the agent to keep it local and avoid exposing credentials. No credential capture or exfiltration is implemented. skill-card.md:25 Risk: Analysis may involve sensitive datasets, credentials, or business metrics supplied by the user. |
| info | Declared output may include shell commands The skill card says outputs may include shell commands when appropriate. The package itself contains no shell executable code; any generated command would be authored by the agent for the user's analysis task. skill-card.md:45 **Output Type(s):** [text, markdown, code, shell commands, configuration, guidance] |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| clawic.com | not in the service index | SKILL.md:5 |
| Binaries invoked | none |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 1 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 165 | 3f1e1a7093c7391e… |
_meta.json | 6 | 6da52f342b4a1ad1… |
chart-selection.md | 40 | 01d040c85f79df83… |
decision-briefs.md | 45 | e9a4a5ae1fbe0950… |
metric-contracts.md | 48 | 074be3abdc962420… |
pitfalls.md | 120 | 88eb29fc1e307bbb… |
skill-card.md | 59 | a832d903bc77ac18… |
techniques.md | 169 | e073dd1b2af9bed0… |
For agents
JSON: https://agenteconomy.report/k/data-analysis.audit.json · badge: https://agenteconomy.report/k/data-analysis.audited.svg ·
skill rating: /k/data-analysis · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).