ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Office Document Specialist Suite 1.0.2

v1.0.0

Advanced suite for creating, editing, and analyzing Microsoft Office documents (Word, Excel, PowerPoint). Provides specialized tools for automated reporting...

⭐ 0· 70·1 current·1 all-time
by@lbtylb
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill advertises Word, Excel, and PowerPoint functionality. The included Python code (ods.py) only implements .docx (Word) operations; there is no code handling .xlsx or .pptx. SKILL.md metadata lists extra pip packages (openpyxl, python-pptx) needed for Excel/PPT support, but requirements.txt and setup.sh only install python-docx and lxml. This is an overpromise / capability mismatch.
✓
Instruction Scope
Runtime instructions are limited to creating a virtualenv and installing requirements via setup.sh and then running ods.py. The instructions do not request or read unrelated system files, environment variables, or external endpoints. Note: SKILL.md's metadata lists additional pip packages that the provided installation script does not install, which could cause runtime errors or confusion.
ℹ
Install Mechanism
There is no registry install spec; installation is via the included setup.sh which creates a local venv and runs pip install -r requirements.txt. This is a low-risk, standard approach, but the requirements.txt omits packages declared in SKILL.md metadata (openpyxl, python-pptx), so the installer does not match the declared dependencies.
✓
Credentials
The skill requests no environment variables or credentials and requires only python3. That is proportionate to a local document-manipulation script. No secret access is requested.
✓
Persistence & Privilege
The skill does not request persistent or elevated privileges; flags indicate it is user-invocable and not always-enabled. It does not modify other skills or system-wide configurations.
What to consider before installing
This package appears safe to run in that it doesn't ask for credentials or make network calls, but it is inconsistent and likely incomplete: it claims Word/Excel/PowerPoint support while the code only implements Word and the installer only installs python-docx and lxml. Also the embedded metadata (ownerId/version) differs from the registry metadata, which may indicate repackaging or a packaging error. Before installing: (1) verify the publisher/source and prefer packages with a homepage or known author; (2) if you need Excel/PPT support, confirm those features exist and the installer includes openpyxl/python-pptx; (3) run setup.sh inside an isolated environment (container or VM) to limit risk; (4) consider contacting the author or rejecting the skill if provenance is unclear.

Like a lobster shell, security has layers — review code before you run it.

latestvk97etcapeyy0pq7y8p4x3v26c983zdp5

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📄 Clawdis
Binspython3

Comments