Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

court-notice

v1.0.0

法院文书自动处理技能。当用户收到、转发法院短信,或要求处理/解析法院文书PDF时触发。自动完成:下载PDF→提取信息→判断文书类型→创建日历(传票/出庭通知)→设置提前1天提醒→生成概要报告→PDF存桌面。全程零弹窗、零手动操作。

0· 80·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for breezewang19/court-notice.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "court-notice" (breezewang19/court-notice) from ClawHub.
Skill page: https://clawhub.ai/breezewang19/court-notice
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install court-notice

ClawHub CLI

Package manager switcher

npx clawhub@latest install court-notice
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
Name/description match the scripts' functionality (parsing PDFs, creating calendar events, scheduling reminders). However the registry metadata declares no required binaries/dependencies while the code clearly uses system tools (osascript/AppleScript via osascript, launchctl, curl, python3 and the pypdf package). The omission of these required tools/deps in the manifest is an incoherence and should have been declared.
!
Instruction Scope
SKILL.md instructs automatic downloading of arbitrary PDF links from SMS, extraction of full PDF text, creation of calendar events via AppleScript, writing launchd plists and loading them (persistent scheduled notifications), and saving PDFs to the user's Desktop — all without user interaction. Those steps go beyond simple parsing: they modify user files and system schedulers and will likely require macOS permissions. The SKILL.md claim of 'zero prompts, zero manual operation' is unrealistic and grants broad discretion to act on arbitrary links.
Install Mechanism
There is no install spec (instruction-only), and all code is bundled in the repo (no remote downloads). That lowers supply-chain risk. However the skill relies on external runtime pieces (pypdf, python3, osascript, launchctl, curl) which are not declared; missing dependency declarations are a usability and security concern but not evidence of remote malicious install behavior.
Credentials
The skill does not request secrets or environment variables, which is appropriate. It does, however, read/write user files and system LaunchAgents and create calendar events — actions proportional to the claimed purpose but more invasive than a pure parser. No unexplained credentials are requested.
!
Persistence & Privilege
The create script writes a plist into ~/Library/LaunchAgents and calls launchctl load, creating persistent scheduled notifications. It also creates calendar events and deletes old events by description content. This gives the skill ongoing presence on the user's account and the ability to trigger notifications without further user interaction; that persistence should be explicit and controllable by the user.
What to consider before installing
This skill mostly does what it says (parse PDFs, create calendar events, schedule reminders), but it performs system-level actions on macOS: it downloads links to ~/Desktop, creates AppleScript events in Calendar (via osascript), and writes+loads launchd plists in ~/Library/LaunchAgents. Before installing or invoking it, consider: 1) Review the included scripts line-by-line (they are bundled) and ensure you trust the source; 2) Only allow it to process links from trusted senders — it will download and execute operations on arbitrary URLs; 3) Expect macOS permission prompts (Calendar access, Automation/Accessibility) despite the 'zero prompts' claim; 4) If you don't want persistent agents, do not let it write/load the plist (or modify the code to skip that step); 5) Ensure python3 and pypdf are installed in a controlled environment; 6) Run the scripts manually first to confirm behavior and avoid automatic processing of untrusted SMS links. The manifest should have declared required tools (osascript, launchctl, curl, python3, pypdf); their absence in metadata is a red flag—proceed only after confirming those details.

Like a lobster shell, security has layers — review code before you run it.

latestvk977hbcy29xs4eeh1nw4rk1jvs84f60d
80downloads
0stars
1versions
Updated 2w ago
v1.0.0
MIT-0

法院文书自动处理

工作流程

收到法院短信后,按以下步骤处理:

1. 解析链接 → 下载PDF到桌面
2. pypdf提取文本内容
3. 判断文书类型(传票/出庭通知→建日历,其他→仅汇报)
4. AppleScript直接写入"工作"日历(无弹窗)
5. launchd plist设置提前1天系统通知提醒
6. 生成文书概要报告
7. PDF存桌面回传用户

判断规则

文书类型关键词处理
传票/出庭通知开庭审理、开庭时间、传唤✅ 建日历
撤诉裁定撤诉、裁定准予📋 仅汇报
应诉通知书应诉、答辩✅ 建日历
其他-📋 仅汇报

关键信息提取

从PDF提取:

  • 案号:正则匹配 (\d{4}).+\d+号
  • 案由:案由行
  • 被传唤人:被传唤人行
  • 开庭时间:年月日+时间
  • 地点:法庭/地点行

执行脚本

1. PDF解析

python3 skills/court-notice/scripts/parse_court_pdf.py <pdf路径>

2. 创建日历

python3 skills/court-notice/scripts/create_court_calendar.py <案号> <案由> <YYYY-MM-DD HH:MM> <地点> [日历名称] [PDF链接]

时间格式:YYYY-MM-DD HH:MM(如 2026-04-24 10:00

launchd plist存至 ~/Library/LaunchAgents/com.mm.court-{案号hash}.plist

3. 下载PDF到桌面

curl -s -o ~/Desktop/recv_court_notice.pdf "<链接>"

日历事件内容

字段内容
summary⚖️ 开庭:{案由}
description案号 - 案由 - 开庭地点(纯文本,不含链接)
urlPDF链接(从短信链接传入)
location开庭地点
start/end开庭时间(2小时时长)

注意:description不含URL,保持纯净;URL通过AppleScript的url属性传入日历事件,点开事件可直接访问PDF。

标准短信模板

收到法院短信时,自动按以下格式处理:

【{法院名称}】{法院名称}向您发送了{案号}案件及相关文书,请及时签收。点击链接查阅:{链接}

输出格式

处理完成后输出:

📋 文书概要

类型:{传票/裁定书/...}
案号:{案号}
案由:{案由}
当事人:{被传唤人/原告/被告}
开庭时间:{时间}
地点:{地点}

✅ 完成清单
- 📄 PDF → 桌面
- 📅 日历 → 已创建("工作"分组,含PDF链接)
- ⏰ 提醒 → 提前1天

参考资料

更新记录

  • 2026-04-08:新增PDF链接支持(url字段),description不再放链接

Comments

Loading comments...