Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Product Doc Reader
v1.0.0产品工程图纸结构化提取器 v5.0。pdftotext 优先 + Vision 兜底,支持软连字符清理/跨行关联/数据校验。专为 Farreach 线材产品图纸设计。
⭐ 0· 108·0 current·0 all-time
byJaden's built a claw@cjboy007
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
Name/description (PDF → structured JSON/MD) aligns with the included Python scripts and examples. Expectation of pdftotext / pdftoppm / optional Tesseract is coherent for the stated extraction job. However the skill also documents and includes code/notes that reference Vision API (Gemini via OpenRouter) and Google Drive batch processing — those capabilities legitimately require API access and credentials, yet no environment variables or credentials are declared in the metadata.
Instruction Scope
SKILL.md and DEVELOPMENT_SUMMARY explicitly mention Vision API fallback (Gemini 2.5 Flash / OpenRouter) and Drive search / batch upload logic. The runtime instructions show only running python3 scripts locally, but the scripts (e.g., batch_process_drive.py, extract_vision.py, extract_hybrid.py) almost certainly make network requests or call external services. SKILL.md does not specify where API keys should come from, nor does it constrain network behavior — that grants broad discretion to the bundled scripts and is scope-creeping compared to a purely local pdftotext-based extractor.
Install Mechanism
No install spec — skill is delivered as files + instructions and expects system binaries (python3, pdftoppm). That is lower-risk than an installer that downloads/extracts arbitrary code. The presence of several Python scripts means code will run when invoked; no remote installer URLs or archive extraction steps were provided in the manifest.
Credentials
The skill declares no required env vars, but multiple parts of the documentation and examples reference external services: Vision/OpenRouter and Google Drive. Those services require API keys or OAuth tokens (not declared as requires.env or primaryEnv). This is an inconsistency: the code likely expects credentials in the environment or local config but the manifest gives no explicit, least-privileged credential requirements. That increases the chance of accidental credential exposure or of the scripts attempting to prompt for/use credentials from unrelated places.
Persistence & Privilege
always is false and the skill is user-invocable. There is no request for permanent platform-wide presence. Nothing in the provided metadata indicates the skill will modify other skills or agent-wide settings. That is proportionate.
What to consider before installing
What to consider before installing/running:
- Expect this to run code: the package includes multiple Python scripts (extract_hybrid.py, extract_vision.py, batch_process_drive.py). Review those scripts before running. Search them for network calls (requests, urllib, openai/openrouter SDKs, googleapiclient, sockets) and any hardcoded endpoints.
- Credentials mismatch: the docs mention Vision (Gemini/OpenRouter) and Google Drive operations but the manifest does not declare required API keys. If you run the scripts, they may look for API keys in your environment, local config, or attempt to prompt/use CLI tools — be cautious about providing secrets.
- Sandbox first: run the tool offline or in a VM/container without network access (or with network blocked) to confirm local-only behavior when you only want pdftotext-based extraction. Then enable network only after you’ve inspected code and configured minimal, scoped credentials.
- Inspect batch_process_drive.py carefully: it may upload or delete files on Drive. If you use it, ensure it targets a test Drive account or that you understand exactly what it will read/write.
- If you need Vision fallback, prefer creating a dedicated, limited-scope API key/account and monitor outgoing traffic. Consider replacing or instrumenting the script calls to OpenRouter/OpenAI to log endpoints and data before sending.
- If you’re not comfortable auditing Python code, ask the maintainer for a short summary of what external endpoints the scripts call, and for a minimal configuration example that shows required env vars and where outputs are sent.
If you provide the content of scripts/extract_hybrid.py and batch_process_drive.py I can do a targeted review and point to exact lines that perform network or Drive/OpenRouter calls.Like a lobster shell, security has layers — review code before you run it.
latestvk974919efspp4r52nskpyvtys183qmkc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📐 Clawdis
Any binpython3, pdftoppm
