Word To Jpg

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill appears to perform the advertised local Word-to-JPG conversion, but users should note the manual dependency install, Word automation, and leftover temporary document copy.

This skill looks coherent for local Word-to-JPG conversion. Before installing, make sure you are comfortable installing the listed Python packages, using Microsoft Word automation, and converting only trusted documents. If the document is sensitive, delete both the generated images and ~/.openclaw/workspace/temp/source.docx when finished.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The packages installed at runtime may vary over time depending on the Python environment and current PyPI versions.

Why it was flagged

The skill relies on manually installed, unpinned PyPI packages. This is expected for the converter, but versions and package provenance are not fixed by an install spec.

Skill content

pip install comtypes pymupdf -q

Recommendation

Install in a trusted environment, and prefer a declarative install spec or pinned dependency versions.

Medium

#ASI05: Unexpected Code Execution

What this means

Converting untrusted Word documents may depend on your local Word security settings and could expose you to normal Office document risks.

Why it was flagged

The converter opens Word documents through the local Microsoft Word COM interface in a hidden Word instance. This is disclosed and purpose-aligned, but the script does not show explicit macro or active-content disabling.

Skill content

word = comtypes.client.CreateObject("Word.Application")
word.Visible = False
...
doc = word.Documents.Open(docx_path, ReadOnly=True)

Recommendation

Convert only trusted documents, ensure Office macros/protected-view settings are safe, or run the conversion in a sandboxed environment.

Low

#ASI06: Memory and Context Poisoning

What this means

A private Word document may remain locally in the OpenClaw temp workspace after the JPGs are created.

Why it was flagged

The script copies the source document into ~/.openclaw/workspace/temp as source.docx and does not remove that copied source file after conversion.

Skill content

temp_path = os.path.join(TEMP_DIR, "source.docx")
shutil.copy2(source_path, temp_path)

Recommendation

Delete the temp source file after conversion, or update the script to clean it up automatically when the task finishes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Previous generated images in ~/.openclaw/media/outbound/word-images may be removed when you run another conversion.

Why it was flagged

Before rendering a new document, the script deletes existing JPG/PNG files in its own output directory.

Skill content

for f in os.listdir(output_dir):
    if f.endswith(('.jpg', '.png')):
        os.remove(os.path.join(output_dir, f))

Recommendation

Copy or rename outputs you want to keep, or use per-document output folders.