Skills data-analysis
📦

data-analysis

v1.0.0 Content revision r1 High Risk ⚙️ External commands🔑 Env variables

Analyze Data and Build Charts

Teams often need quick analysis scripts and consistent charts from structured data. This skill generates Python workflows using pandas, NumPy, matplotlib, and seaborn for sandboxed review.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "data-analysis" from https://skillstore.io/skills/bohuyeshan-apb-data-analysis.md and its manifest at https://skillstore.io/api/skills/bohuyeshan-apb-data-analysis/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/bohuyeshan-apb-data-analysis.md Signed manifest GET /api/skills/bohuyeshan-apb-data-analysis/manifest Signed lockfile GET /api/skills/bohuyeshan-apb-data-analysis/lockfile

Test it

Using "data-analysis". A sales table with region, date, revenue, and product category columns.

Expected outcome:

A Python analysis workflow that groups revenue by region and category, reports missing values, and saves a styled comparison chart.

Using "data-analysis". A customer activity dataset with signup date, plan, and monthly usage fields.

Expected outcome:

A time-based analysis plan with monthly aggregation, plan-level comparisons, and a line chart for usage trends.

Using "data-analysis". A survey export with rating columns and free-form labels.

Expected outcome:

A cleaning and visualization workflow that summarizes response distributions and creates a readable heatmap.

Security Audit

High Risk
v12 • 7/9/2026 Open versioned report

The backtick findings are false positives caused by Markdown inline code and code fence parsing, not shell execution. The skill does read OpenAI API configuration from environment and application settings, and it generates runnable Python code from user-provided context, so publication should require clear sandbox and credential handling guidance.

3
Files scanned
120
Lines analyzed
11
Review items
0
False positives ignored

Confirmed security concerns (1)

High
scripts/code_generator.py:21-50SKILL.md:28
Model-Generated Python Intended for Execution
The skill generates complete runnable Python scripts from user-supplied data context and requirements, and the documentation says the code can be executed in a sandbox. This is useful, but unsafe execution outside a sandbox could run unintended code over local files or data.
The code explicitly asks an LLM to write a complete runnable Python script, extracts the returned code, and returns it. The documentation confirms this generated code is intended for sandbox execution.
Capability review items (11)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
scripts/code_generator.py:11
Generic API/secret keys
api_key = role_config.get("api_key") or os.getenv("OPENAI_API_KEY")
The code obtains an API key from config or OPENAI_API_KEY. No hardcoded secret is present, but runtime secret access is real.
High
scripts/code_generator.py:14
Generic API/secret keys
if not api_key:
The condition branches on whether an API key exists, confirming credential-dependent behavior. This is not a literal secret, but it is part of runtime secret handling.
High
scripts/code_generator.py:16
Generic API/secret keys
api_key = settings.OPENAI_API_KEY
The code falls back to settings.OPENAI_API_KEY. This is direct application secret access and should be disclosed.
High
scripts/code_generator.py:19
Generic API/secret keys
return AsyncOpenAI(api_key=api_key, base_url=base_url)
The API key is passed into AsyncOpenAI along with a configurable base URL. This is expected usage, but it creates credential exposure risk if endpoint configuration is untrusted.
Low
scripts/code_generator.py:11
Python getenv function
api_key = role_config.get("api_key") or os.getenv("OPENAI_API_KEY")
The code reads OPENAI_API_KEY from the environment. This is intentional credential access and must be disclosed and protected.
Low
scripts/code_generator.py:12
Python getenv function
base_url = role_config.get("base_url") or os.getenv("OPENAI_BASE_URL")
The code reads OPENAI_BASE_URL from the environment and uses it for the client endpoint. A configurable endpoint affects where API credentials are sent.
Low
scripts/code_generator.py:11
getenv function call
api_key = role_config.get("api_key") or os.getenv("OPENAI_API_KEY")
The getenv call directly accesses OPENAI_API_KEY. The behavior is legitimate for an OpenAI client but remains real environment secret access.
Low
scripts/code_generator.py:12
getenv function call
base_url = role_config.get("base_url") or os.getenv("OPENAI_BASE_URL")
The getenv call reads OPENAI_BASE_URL and influences the destination for the API client. This is real environment configuration access.
Low
scripts/code_generator.py:10
Configuration library
role_config = self.config.get("researcher") or {} # Re-use researcher config
The code reads researcher configuration that may include credential and endpoint values. This is expected configuration access but relevant for marketplace risk disclosure.
Low
scripts/code_generator.py:11
Configuration library
api_key = role_config.get("api_key") or os.getenv("OPENAI_API_KEY")
The configuration value may provide api_key before falling back to the environment. This is real credential configuration access.
Low
scripts/code_generator.py:12
Configuration library
base_url = role_config.get("base_url") or os.getenv("OPENAI_BASE_URL")
The configuration value may provide base_url for the OpenAI client. Endpoint configuration should be treated as security-sensitive when paired with an API key.

Risk Factors

⚙️ External commands (9)
scripts/code_generator.py:26 scripts/code_generator.py:27 scripts/code_generator.py:29 scripts/code_generator.py:46-47 scripts/code_generator.py:47 scripts/code_generator.py:48-49 scripts/code_generator.py:49 SKILL.md:31 SKILL.md:32
🔑 Env variables (11)
scripts/code_generator.py:11 scripts/code_generator.py:12 scripts/code_generator.py:11 scripts/code_generator.py:12 scripts/code_generator.py:10 scripts/code_generator.py:11 scripts/code_generator.py:12 scripts/code_generator.py:11 scripts/code_generator.py:14 scripts/code_generator.py:16 scripts/code_generator.py:19
Audited by: claude View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/bohuyeshan-apb-data-analysis/audits/12?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/bohuyeshan-apb-data-analysis/security.svg)](https://skillstore.io/skills/bohuyeshan-apb-data-analysis?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/bohuyeshan-apb-data-analysis?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/bohuyeshan-apb-data-analysis/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/bohuyeshan-apb-data-analysis.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

BOHUYESHAN-APB. (2026). data-analysis security audit report (audit version 12) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/bohuyeshan-apb-data-analysis/audits/12

BibTeX citation

@techreport{bohuyeshan-apb-bohuyeshan-apb-data-analysis-2026, author = {BOHUYESHAN-APB}, title = {data-analysis security audit report (audit version 12)}, institution = {Skillstore}, year = {2026}, number = {12}, url = {https://skillstore.io/skills/bohuyeshan-apb-data-analysis/audits/12}, note = {Author version 1.0.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "data-analysis security audit report (audit version 12)" version: "1.0.0" type: report authors: - name: "BOHUYESHAN-APB" date-released: "2026-07-09" url: "https://skillstore.io/skills/bohuyeshan-apb-data-analysis/audits/12" identifiers: - type: other value: "skillstore:bohuyeshan-apb-data-analysis:audit:12" description: "Skillstore immutable audit report identifier"

Compare variants

3 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score
supercent-io Recommended

supercent-io-data-analysis

Skillstore Score 78
Evidence Confidence High
Skillstore usage 37
Updated

2026-08-21

Acurioustractor

acurioustractor-data-analysis

Skillstore Score 70
Evidence Confidence High
Skillstore usage 15
Updated

2026-08-21

BOHUYESHAN-APB Current

bohuyeshan-apb-data-analysis

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 10
Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium
45
Architecture
100
Maintainability
87
Content
70
Community
83
Spec Compliance

What You Can Build

Explore a CSV dataset

Generate a pandas workflow that profiles columns, summarizes missing values, and prepares charts for review.

Create presentation visuals

Build chart scripts that use consistent styling for reports, notebooks, or generated documents.

Prototype analysis automation

Turn a plain language analysis requirement into a runnable Python script for a controlled sandbox.

Try These Prompts

Summarize a small dataset 
Analyze this dataset context and create a simple Python script that summarizes key columns and missing values. Include one clear chart.
Compare groups in tabular data 
Create analysis code that groups the data by the named category, compares the main metric across groups, and saves a readable bar chart.
Investigate trends over time 
Generate a Python analysis script that parses the date column, aggregates the metric by month, highlights trend changes, and saves a line chart.
Build a chart-ready analysis workflow 
Use the supplied data context to create a complete sandbox-ready analysis script. Clean invalid rows, compute grouped metrics, and produce one publication-quality visualization.

Best Practices

  • Run generated scripts only in a sandbox with limited file and network access.
  • Provide clear column names, data types, and the exact question to answer.
  • Review generated analysis steps before using results in business decisions.

Avoid

  • Do not run generated code directly on sensitive production systems.
  • Do not include secrets or private customer data in the analysis prompt.
  • Do not assume generated charts prove causation without statistical review.

Frequently Asked Questions

What does this skill generate?
It generates Python analysis and visualization scripts using pandas, NumPy, matplotlib, and seaborn.
Does it execute the generated code?
The reviewed files generate code for sandbox use. Safe execution depends on the host environment.
Which credentials does it need?
It uses an OpenAI-compatible API key and optional base URL from configuration or environment variables.
Can it analyze any file type?
The skill is oriented toward structured data context. File loading support depends on the surrounding application.
Can Claude Code use this skill?
Yes. The report lists Claude Code, Claude, and Codex as supported tools.
How should I review the output?
Check the cleaning steps, aggregation logic, chart labels, and sandbox controls before running or sharing results.

Developer Details

License

MIT

Author version

v1.0.0

Skillstore revision

r1

Repository

https://github.com/BOHUYESHAN-APB/N-T-AI/tree/main/backend/app/skills/common/data_analysis_skill

Ref

7db9b9f06e0ab79c575b58bc48c4d8dc9849f424

Maintenance freshness

7/18/2026

Usage

7 downloads · 183 views

File structure

📁 scripts/

📄 code_generator.py

📄 visualizer.py

📄 SKILL.md