data-report Eval
================

Status: failed
Score: 71/100
Risk: high
Decision: do_not_auto_install
Policy: block
Reason: Install path: No install command or repository handoff is available.

Install:


Required checks:
- PASS Task fit: Task wording matches this skill metadata.
- FAIL Install path: No install command or repository handoff is available.
- PASS Install command safety: standard package or runtime install path
- WARN Trust score: Potentially useful, but at least one trust signal needs human inspection.
- WARN Audit score: Needs review
- WARN Agent safety gate: Usable candidate, but the agent should surface permission and audit notes before installation.
- PASS License clarity: Apache-2.0
- PASS Permission surface: filesystem or document access

Warnings:
- Trust score: Potentially useful, but at least one trust signal needs human inspection.
- Audit score: Needs review
- Agent safety gate: Usable candidate, but the agent should surface permission and audit notes before installation.
- README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context
- No explicit sanitization/escaping rule: user data is inserted into an HTML/JS report, so malicious CSV/Excel/JSON strings could become HTML or script if not escaped and JSON-encoded.
- The tracked source changed or could not be synchronized. Review the current source before installing.
- Parsing workflow is underspecified: SKILL.md says to parse user input but does not explain how to handle CSV delimiters, Excel conversion, JSON schema normalization, missing values, or date formats.
- Limitations are missing: no guidance for large datasets, offline/no-CDN environments, non-numeric data, or cases where year-over-year comparison is unavailable despite the template requiring 同比变化.
- The skill files do not include an explicit license/attribution notice, and open-design.json uses the name "example-data-report" instead of "data-report", making provenance slightly less clear.
- Quality score needs review
- GitHub adoption: 77 GitHub stars
- Stars/forks activity: 77 stars, 49 forks; issue activity unavailable in current metadata

Validation plan:
1. Inspect repository, README/SKILL.md, license, and recent commits before production use.
2. Install in an isolated workspace or sandbox with no production secrets available.
3. Run the smallest representative task and record files touched, commands run, network access, and outputs.
4. Compare the selected skill against at least one alternative when the eval status is review or failed.
5. Promote only after the agent reports a successful verification result and unresolved warnings are accepted.

Do not use when:
- teams that need a vendor-supported SLA
- production agents without a repository review
- No explicit sanitization/escaping rule: user data is inserted into an HTML/JS report, so malicious CSV/Excel/JSON strings could become HTML or script if not escaped and JSON-encoded.
- The tracked source changed or could not be synchronized. Review the current source before installing.
- Parsing workflow is underspecified: SKILL.md says to parse user input but does not explain how to handle CSV delimiters, Excel conversion, JSON schema normalization, missing values, or date formats.
- Limitations are missing: no guidance for large datasets, offline/no-CDN environments, non-numeric data, or cases where year-over-year comparison is unavailable despite the template requiring 同比变化.
- The skill files do not include an explicit license/attribution notice, and open-design.json uses the name "example-data-report" instead of "data-report", making provenance slightly less clear.
- Quality score needs review

URLs:
- Skill: https://www.openagentskill.com/skills/lazyagi-data-report
- Audit: https://www.openagentskill.com/skills/lazyagi-data-report/audit
- JSON: https://www.openagentskill.com/api/agent/evals?slug=lazyagi-data-report