文游剧本生成系统

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI05: Unexpected Code Execution

What this means

Using the export feature will run a local Python script and create a document on the Desktop.

Why it was flagged

The skill asks the agent to run a local Python helper to create a Word document. This is disclosed and directly supports the export feature, but it is still local command execution.

Skill content

python "SKILL_DIR/scripts/export_word.py" "$HOME/Desktop/文字游戏剧本_<标题>.docx" "<标题>" - <<EOF

Recommendation

Use the export step only when you want a local Word file, and confirm the output filename/path is appropriate.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the dependency may fetch the latest available package version from the Python package index.

Why it was flagged

The skill depends on the external python-docx package for Word export, but the package version is not pinned and no install spec declares it.

Skill content

需要安装 python-docx：
```bash
pip install python-docx
```

Recommendation

If installing manually, prefer a trusted Python environment and consider pinning a known-good python-docx version.

Note

ASI02: Tool Misuse and Exploitation

What this means

A malformed or unintended filename/path could create or overwrite a document in an unexpected location.

Why it was flagged

The export helper writes to the path passed on the command line. SKILL.md scopes this to the Desktop, but the script itself accepts any output path.

Skill content

output_path = sys.argv[1]
...
doc.save(output_path)

Recommendation

Keep exports to a clear Desktop path and avoid titles containing path separators or unusual filename characters.