Nutrient Openclaw

ReviewAudited by ClawScan on May 1, 2026.

Overview

This is a coherent Nutrient document-processing integration, but it sends documents to a third-party API and uses an API key, so users should only process files they are allowed to upload.

Before installing, confirm you are comfortable using the external npm package and uploading documents to Nutrient DWS. Configure a separate least-privilege API key if possible, start with non-sensitive files, and review any redaction, watermarking, or signing output before relying on it.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Sensitive or regulated documents may be uploaded to Nutrient DWS when the tools are used.

Why it was flagged

The skill explicitly discloses that files or extracted content are sent to a third-party provider for processing.

Skill content
`nutrient_*` operations send the file or extracted document content to Nutrient DWS for processing.
Recommendation

Use the skill only for documents your organization permits uploading to Nutrient, and review Nutrient's security and privacy terms before using production data.

What this means

Use of the skill may consume API credits or access account-level document-processing features under the configured key.

Why it was flagged

The skill requires a Nutrient API key for delegated access to the provider account.

Skill content
apiKey: "your-api-key-here"
Recommendation

Use a separate, least-privilege API key where possible and rotate it if it is exposed.

What this means

The installed package code, not just this instruction file, will determine the runtime behavior.

Why it was flagged

The install path depends on an external npm package rather than code included in the supplied artifacts.

Skill content
node | package: @nutrient-sdk/nutrient-openclaw
Recommendation

Install from the expected npm package/repository and verify the package version before use.

What this means

The agent can help create modified or signed documents when asked, which may have business or legal impact.

Why it was flagged

The tool list includes document-mutating operations, including digital signing, watermarking, and redaction.

Skill content
| `nutrient_sign` | Digitally sign PDF documents |
Recommendation

Review document changes carefully and require explicit user approval before finalizing or sharing signed, redacted, or watermarked files.