Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
eCTD XML Compiler
v1.0.0Automatically convert uploaded drug application documents (Word/PDF) into XML skeleton structure compliant with eCTD 4.0/3.2.2 specifications.
⭐ 0· 28·0 current·0 all-time
byAIpoch@aipoch-ai
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name, description, and the included script align with converting Word/PDF into eCTD XML skeletons. However there are small mismatches: SKILL.md and requirements mention support for '.doc' files, but the implementation relies on python-docx which only handles .docx; requirements.txt lists 'docx' and 'pypdf2' (lowercase) which do not precisely match the commonly used pip package names ('python-docx' and 'PyPDF2'). These are coherence/maintenance issues rather than evidence of malicious intent.
Instruction Scope
SKILL.md gives explicit, scoped runtime instructions (run py_compile, run the script with arguments, confirm I/O). It does not instruct reading unrelated system files or environment variables, nor does it specify external network endpoints. The instructions do recommend editing an in-file CONFIG block if present — you should verify whether that block exists and what it changes before editing or running.
Install Mechanism
There is no install spec that downloads remote code; the package is instruction-only with bundled Python code and a requirements.txt. This is a lower-risk install model. Note: the requirements file may reference inexact package names which could cause confusion when installing dependencies.
Credentials
The skill does not request environment variables, credentials, or config paths. All declared and implied needs (local file input and local output directory) are proportionate to the stated purpose.
Persistence & Privilege
The skill is not always-enabled and is user-invocable. It does not request persistent system-wide privileges or modify other skills. Autonomous invocation is allowed by default but that alone is not a red flag here.
What to consider before installing
This package appears to implement the advertised eCTD XML skeleton conversion, but there are multiple quality and coherence issues you should address before using it on real or sensitive documents:
- Do not run on sensitive production submissions until you audit the code. Review scripts/main.py fully for any unexpected I/O or network calls (the visible portion shows no network activity but the file is truncated in the listing).
- Confirm dependency names and install into an isolated virtual environment. requirements.txt lists 'docx' and 'pypdf2' while the code expects python-docx and PyPDF2; install the correct packages (pip install python-docx PyPDF2 lxml) and test imports.
- Test with non-sensitive sample documents. The code contains clear bugs (for example, in generate_xml it references module_dir before it is defined) and may raise runtime errors or produce incomplete output. Run python -m py_compile scripts/main.py and then execute with small inputs to see behavior.
- Check that the script does not modify files outside the intended output directory and that any CONFIG block it mentions is safe to edit (search the repository for CONFIG). If the script writes or overwrites files, back up originals first.
- Confirm .doc support: the tool claims .doc support but python-docx does not parse legacy .doc files; convert .doc to .docx before feeding it in or verify fallback behavior.
- Verify MD5 usage: the tool writes MD5 checksums for integrity; be aware MD5 is not cryptographically secure for tamper detection, but is commonly used for simple checksums.
If you are not comfortable auditing the code yourself, ask the developer for clarification (source repository, full script, and corrected dependency list) or run the tool inside a sandboxed environment (isolated VM/container) before trusting outputs for regulatory submissions.Like a lobster shell, security has layers — review code before you run it.
latestvk971t3s4p9c68tt23ja8dfz9sh8413am
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
