chinese gongwen writing

AdvisoryAudited by Static analysis on May 13, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing the optional renderer dependency will fetch code from the Python package ecosystem.

Why it was flagged

The skill depends on an external Python package with a lower-bound version rather than an exact pin. This is common for a DOCX renderer, but users should be aware of the package dependency.

Skill content
python-docx>=1.1
Recommendation

Install dependencies in a virtual environment from a trusted package index, and pin or review versions if using the skill in a controlled workplace environment.

What this means

If you request DOCX output, the agent may run local code and create or overwrite the output file path you provide.

Why it was flagged

The optional renderer runs local Python code that reads a selected input file and writes a DOCX output file. This is expected for the advertised DOCX generation feature.

Skill content
text = Path(draft_path).read_text(encoding="utf-8") ... doc.save(out_path)
Recommendation

Use explicit draft and output paths you trust, review generated documents before sending them, and avoid pointing the output at important existing files.