Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Word Deliverable

v0.9.6

Turn financial-services outputs into a polished Word deliverable. Use when the user wants an IC memo, customer memo, internal note, diligence summary, or ban...

0· 104·0 current·0 all-time
byjackdark@jackdark425

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jackdark425/word-deliverable.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Word Deliverable" (jackdark425/word-deliverable) from ClawHub.
Skill page: https://clawhub.ai/jackdark425/word-deliverable
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install jackdark425/word-deliverable

ClawHub CLI

Package manager switcher

npx clawhub@latest install word-deliverable
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (produce banker-grade .docx deliverables) matches the instructions to author real .docx files and preserve tables/headings. However, the SKILL.md mandates use of specific helper tools and scripts (minimax-docx, aigroup-mdtoword-mcp, validate-delivery.py, extract_deck_numbers.py, and certain deliverable-dir files) without declaring any required files, install steps, or config paths. The skill also claims it 'vendors the MiniMax DOCX skill' but the package contains no code files. This mismatch between claimed bundled tooling and the actual instruction-only packaging is unexpected and should be confirmed.
Instruction Scope
Instructions are focused on collecting source material, structuring a memo, and producing a .docx with provenance checks (especially for CN targets). That scope is appropriate for a Word deliverable skill. However, the CN pre-flight mandates running local scripts (validate-delivery.py and extract_deck_numbers.py) and reading files under <deliverable-dir>/analysis.md, data-provenance.md, and raw-data/*.json. Those file/command dependencies are not declared in the skill metadata, so the runtime instructions implicitly assume access to specific local files and scripts that may not exist in the host environment.
Install Mechanism
This is an instruction-only skill with no install spec or code files (lowest install risk). Still, SKILL.md asserts it 'vendors the MiniMax DOCX skill' and treats `aigroup-mdtoword-mcp` as a first-class companion, but no such vendored artifacts are present in the manifest. This is an inconsistent claim rather than an installation risk, but it means the skill's runtime behavior depends on external/absent tooling.
Credentials
The skill requests no environment variables, credentials, or config paths. The instructions do require reading local deliverable and provenance files for audits and cite local snapshots for CN targets; those accesses are proportionate to the stated deliverable/validation purpose but should be explicitly documented.
Persistence & Privilege
No persistent installation, no always:true flag, and no requests to modify other skills or system-wide settings. Autonomous invocation is allowed by default (platform standard) and does not appear combined with other high privileges here.
What to consider before installing
This skill appears to actually do what it says (produce banker-ready .docx files), but it depends on scripts and companion skills that are not included or declared. Before installing or using it: 1) Verify provenance — ask the publisher for source/homepage or the vendored MiniMax DOCX code the README claims to include. 2) Confirm the host environment provides the helper tools named in SKILL.md (minimax-docx or aigroup-mdtoword-mcp) or that validate-delivery.py and extract_deck_numbers.py exist where the skill expects them. 3) For CN-market targets, confirm the required provenance files (<deliverable-dir>/analysis.md, data-provenance.md, raw-data/*.json) are available and that you trust the validation scripts — they will read local files and can block delivery. 4) Because the skill is from an unknown source and claims vendoring without packaging code, prefer to test it in a controlled environment first and request the author to declare explicit dependencies or provide the helper scripts. If those dependencies are present and legitimate, the skill is coherent; if not, the missing elements are a red flag.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fx9vsngw3fq0kf17fmcdfx1856etz
104downloads
0stars
1versions
Updated 6d ago
v0.9.6
MIT-0
<!-- Derived from anthropics/financial-services-plugins under Apache-2.0. Modified by AIGroup for OpenClaw compatibility and banker workflow packaging. Not an official Anthropic release. -->

Word Deliverable

Use this skill when the user wants a Word document as the final output surface for work produced by this plugin.

Best-fit cases

  • Customer memo after customer-analysis-pack
  • Investment committee memo after datapack-builder
  • Diligence note after comps-analysis, dcf-model, or lbo-model
  • Internal banking brief assembled from multiple plugin outputs

CN target pre-flight (MANDATORY when target is a Chinese-market entity)

For any CN/大陆 target (A股 / 港股中概 / 非上市内资), follow the same raw-data → provenance → analysis.md chain that cn-client-investigation enforces for PPT:

  • The .docx memo MUST source every hard number from <deliverable-dir>/analysis.md or <deliverable-dir>/data-provenance.md. Do not re-derive numbers inside the docx generator.
  • After the docx is written, run validate-delivery.py — its Gate 2c (docx_data_audit.py) scans the memo text and cross-checks every hard number against the provenance table. Missing rows = FAIL; block delivery.
  • If a convenient machine-readable lookup helps the generator, run extract_deck_numbers.py <deliverable_dir> once to emit deck-numbers.json; memo generation code can import that instead of re-typing numbers from analysis.md.
  • Cite raw-data/{ts_code}-*.json MCP snapshots in the memo's footnote if the memo includes banker-grade numbers (parallels PPT's Phase 3.5 requirement).

For non-CN targets, skip this pre-flight and use the generic routing below.

Tooling preference

Prefer the bundled MiniMax-derived Word skill shipped inside this plugin:

  • minimax-docx

Prefer aigroup-mdtoword-mcp__markdown_to_docx as the next routing layer for standard banker memo generation, markdown-to-Word conversion, and table-preserving .docx packaging.

If neither of those paths is available for any reason, fall back to the standard docx workflow already available in the environment.

This plugin now vendors the MiniMax DOCX skill as a convenience layer and treats aigroup-mdtoword-mcp as a first-class companion path for Word output. If the host already has a compatible Word / DOCX skill installed, that is also fine, but a separate MiniMax install should no longer be required for Word output after this plugin is installed.

Do not try to detect host skills by shelling out with which, PATH checks, or executable-name probes. These office capabilities may exist as host-routed skills even when no same-named binary is present in the shell.

Treat skill availability as a routing preference, not a shell-command discovery task.

The core rule is:

  • author the document as a real .docx
  • keep tables and headings structured
  • do not stop at markdown if the user explicitly asked for Word

Preferred routing order:

  1. minimax-docx for higher-fidelity Word generation and template-sensitive deliverables
  2. aigroup-mdtoword-mcp__markdown_to_docx for stable banker memo and report packaging from markdown or structured content
  3. environment docx fallback only when neither of the above is clearly available

Workflow

Step 1: Gather source material

Use existing outputs from this plugin first:

  • customer-analysis-pack
  • datapack-builder
  • comps-analysis
  • competitive-analysis
  • dcf-model
  • lbo-model
  • process-letter

If the user already has markdown, Excel, PPT, or notes, treat them as input material rather than rewriting from scratch.

Step 2: Choose document type

Pick the smallest document that matches the ask:

  • memo
  • briefing note
  • IC summary
  • diligence note
  • board-ready written appendix

Clarify audience and tone only if needed for structure.

Step 3: Build the .docx

Default structure:

# Title
## Executive Summary
## Company Overview / Situation
## Analysis
## Risks
## Recommendation / Next Steps
## Appendix

Requirements:

  • real section headings
  • clean tables instead of pasted ASCII blocks
  • explicit source notes where numbers matter
  • banker-readable prose, not placeholder text
  • if the content is already in markdown or tabular form, strongly prefer aigroup-mdtoword-mcp over manual copy/paste into ad hoc Word flows
  • do not block on shell-based MiniMax detection if the host already routed you into this skill successfully

Step 4: Keep the file lineage clean

If data came from an Excel model or analysis pack, say so in the document or delivery note.

If the user also wants a PDF, finish the Word file first, then hand off to pdf-deliverable.

Output standard

Deliver:

  1. a .docx
  2. a short summary of what the document contains
  3. any open assumptions or numbers still requiring verification

Quality checklist

  • the final artifact is a real .docx, not markdown renamed by hand
  • headings and tables are readable in Word
  • numbers match the underlying plugin output
  • the narrative is concise and banker-usable
  • no fake citations or placeholder sections remain

Comments

Loading comments...