Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →automateyournetwork/network-data-analysis
Ad-hoc read-only SQL analysis over exported network data (Zeek logs, Suricata eve.json, generated reports) using DuckDB.
Passed 10 of 17 test cases with the skill, and 2 of 17 without it.
and 10 more in the full report
11 fixed3 passed either way9 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 11 test cases the skill fixed. Same model, same prompt, with and without the skill.
Which environment variable sets the maximum number of result rows returned by an analysis_query call before truncation occurs?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies ANALYSIS_MAX_RESULT_ROWS as the environment variable for result row caps. | Missed | Passed |
The instructions your model reads when the skill loads.
analysis-mcp (NetClaw-authored, spec 092)analysis_status, analysis_datasets, analysis_queryLoads files from an allowlist of roots — ~/.openclaw/nsm/runs (Zeek/Suricata output
from nsm-mcp), the workspace output directory, and ~/.openclaw/analysis for your own
exports.
NetClaw's own stores are permanently unreachable: ~/.openclaw/memory/,
~/.openclaw/rag/, ~/.openclaw/n2n/ and ~/.openclaw/gait/, plus .ssh, .aws, .kube
and .env. A generic SQL surface over those would be a backdoor, not an analysis tool.
That is not enforced by pattern matching. Datasets are materialised, then DuckDB's own
enable_external_access=false and lock_configuration=true close every filesystem and
network path irreversibly for the life of the process. Verified: read_csv('/etc/passwd'),
glob('/home/**'), ATTACH of the memory or RAG stores, COPY … TO, INSTALL/LOAD, and
re-enabling access all raise.
If you need a file analysed, put it under ~/.openclaw/analysis — do not try to reach it in
SQL, because you cannot.
nsm_analyze (skill nsm-session-pivot) writes Zeek logs and
Suricata eve.json. Without a run, this surface has nothing to read and says so.analysis_status — is the sandbox locked, how many datasets loaded, what are the caps?analysis_datasets — table names, row counts, columns. Read the columns before writing
SQL; guessing column names wastes a round trip.analysis_query — one read statement per call.Zeek tables carry their real column names (id_orig_h, id_resp_p, uid), lifted from
the log's #fields header. Without that they would be column0…columnN and unusable.
test cases passed, vs 2 / 17 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.