Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Shuke Document Formatting

v1.0.1

数科公司文印格式自动化工具包。自动按照数科公司文印格式要求(方正小标宋简体、仿宋GB2312、楷体GB2312、黑体等字体,28字/行,22行/页)格式化Word文档并生成PDF。

0· 79·1 current·1 all-time
byshuchang@an0027
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The scripts and SKILL.md consistently implement document formatting, PDF generation, font installation/verification and batch processing — which aligns with the description. However the package uses several system tools (pandoc, weasyprint, pdffonts, fc-list, reportlab, PyPDF2) that are not listed in the SKILL.md "pre-requirements" nor in the registry metadata. That omission is unexpected and should have been declared.
!
Instruction Scope
Runtime instructions ask you to run install_shuke_fonts.py and conversion scripts. install_shuke_fonts.py will recursively scan directories for TTF files, copy matched fonts into a system-wide directory, update font cache, and write a CSS template into a root workspace path. check_pdf_fonts.py has a hard-coded fallback path (/root/.openclaw/workspace/...) if no PDF argument is provided. These behaviors modify system state and reference root-home paths beyond simply reading or transforming a single user-supplied document.
Install Mechanism
There is no remote install step or downloaded code; this is an instruction + code bundle (no network installers). That lowers risk compared to fetching arbitrary code. The highest-risk action is local file writes to system font directories done by the included install_shuke_fonts.py script.
Credentials
The skill does not request credentials or environment variables (none declared). However it expects and invokes system utilities (pandoc, weasyprint, pdffonts, fc-list, fc-cache) and Python packages (reportlab, python-docx, PyPDF2) which the SKILL.md does not fully declare — this mismatch may lead users to run unchecked commands as root to satisfy requirements. No secret access is requested.
!
Persistence & Privilege
The font installer requires root privileges and writes into /usr/share/fonts/数科文印字体 and updates fc-cache, and it also writes files into a root workspace path (/root/.openclaw/...). Those are legitimate operations for installing system fonts but are high-privilege actions; users should not run them without verifying the font files and source. The skill itself is not marked always:true and does not persist as a background service.
What to consider before installing
What to consider before installing or running this skill: - The code appears to do what the description says (format DOCX → PDF and install/verify fonts), but it performs system-level changes: install_shuke_fonts.py requires root and will copy TTF files into /usr/share/fonts/数科文印字体 and run fc-cache. Only proceed if you trust the font files and the author. - Missing declared dependencies: the SKILL.md lists python-docx but does not list system binaries and Python packages actually used (pandoc, weasyprint, pdffonts/pdfinfo, fc-list/fc-cache, reportlab, PyPDF2). Install those in a controlled environment first (or inspect code) rather than elevating privileges to install them on the system blindly. - Inspect font files before installing: the installer will scan and copy any matching TTFs from the provided directory. Verify that the TTF files are legitimate and licensed for your use; do not install unknown or untrusted fonts as root. - Hard-coded paths: some tools default to /root/.openclaw/workspace paths if no arguments are given. Run the scripts with explicit input/output paths to avoid accidental operations on unexpected files. - Test in an isolated environment: if possible, run the tool in a disposable VM or container first (or in a non-root user account) and avoid running install_shuke_fonts.py as root until you’ve verified the font files and the script behavior. - Backup system fonts: if you decide to install, backup existing font directories first so you can recover if something goes wrong. - If you only need formatting/PDF conversion and not system-wide font installation, try running the conversion tools with local font files or use the generate_proper_example/doc_generator utilities to see behavior without modifying /usr/share. If you want, I can highlight the exact lines that (a) copy files into /usr/share, (b) require root checks, and (c) reference the hard-coded /root workspace paths so you can inspect them directly.

Like a lobster shell, security has layers — review code before you run it.

latestvk97902caej1naghfhjc4eahbfs83s4g5

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments