Toji Doc Extractor
Security checks across malware telemetry and agentic risk
Overview
The skill appears to implement a legitimate document extractor, but SKILL.md and usage examples contain hard-coded, user-specific paths and undocumented dependency expectations that don't align with the registry metadata — review before use.
This skill appears to do what it says (extract text/tables/images including OCR), but exercise caution before installing: SKILL.md includes hard-coded, user-specific paths (e.g., /Users/kong, ~/.openclaw/venvs/doctools, /opt/homebrew/bin) and claims pre-installed libraries/CLI tools that the registry doesn't declare. Before using it: (1) review scripts/extract.py locally (it’s included) to confirm no network calls or hidden behavior (the file here is local and readable), (2) run in a sandbox or VM and test with non-sensitive documents, (3) update the SKILL.md to use relative or configurable paths (or provide an install spec) and ensure dependencies (pymupdf, pdfplumber, python-docx, tesseract, pdftotext) are documented/installed, and (4) be aware the script invokes tesseract via subprocess — ensure that binary is trusted on your system. If you need the skill to run on a multi-user system, ask the author to remove hard-coded home paths and add an installation/setup section that fits the target environment.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
VirusTotal findings are pending for this skill version.