文档内容总结 Summary & Analysis txt/docx/pdf/xlsx/xls

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:14 PM UTC
• Version: 1.0.4

Overview

This skill is a disclosed local document summarizer, with the main cautions being local file contents sent into the OpenClaw LLM flow and automatic installation of document-reading Python packages.

Install only if you are comfortable with a Python-based local file reader. Use a virtual environment or preinstall the listed dependencies yourself, and do not point it at confidential, regulated, or highly private documents unless your OpenClaw LLM data-handling policy allows that content flow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""自动安装Python包（中英双语提示）"""
    print_step(f"正在自动安装依赖库: {package_name}")
    try:
        subprocess.check_call([sys.executable, "-m", "pip", "install", package_name], 
                              stdout=subprocess.DEVNULL, 
                              stderr=subprocess.DEVNULL)
        print(f"✅ 成功安装 {package_name} / Successfully installed {package_name}")

• Confidence: 95% confidence
• Finding: The code invokes pip at runtime through subprocess, which allows the skill to modify the local Python environment during normal document processing. Even though the package name is selected from hardcoded values rather than direct user input, this still expands the attack surface by executing an external package installer, potentially pulling untrusted code from package indexes and changing system state unexpectedly.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares only informal requirements in prose while exposing capabilities that amount to local file reading and shell-like execution via Python, including stated runtime package installation. This is dangerous because users and platforms may under-assess the trust boundary: the skill can access arbitrary local documents and invoke package-management behavior without explicit, structured permission disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented behavior does not match the actual capability set: it claims summary/analysis and external LLM transmission, but the implementation reportedly only extracts content and also performs pip subprocess installation. Behavior mismatches are security-relevant because they prevent informed consent, can hide risky execution paths, and may cause users to expose sensitive files under false assumptions about what the skill will do.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: A document-summary skill should read local files, but this implementation can install Python packages on demand, which is behavior outside the stated purpose. That means opening a document can trigger network access, package resolution, and execution of installer logic, creating supply-chain and environment-integrity risks unrelated to summarization.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The manifest presents this as a local document analysis tool, but the code alters the local environment by installing software. This mismatch is dangerous because users may grant access expecting read-only file handling, while the skill actually performs state-changing operations that can introduce new software, create persistence in the environment, and violate least-privilege expectations.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Broad English triggers like 'summarize for me' or 'analyze for me' can activate in ordinary conversation without a strong file-specific constraint. In a skill with local file access, overbroad activation increases the risk of unintended invocation and accidental disclosure of local document contents.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The Chinese triggers are similarly broad and can match common requests like '帮我总结' or '分析一下' without clearly indicating local-file access. Because this skill reads local documents, ambiguous activation can lead to unintended file operations or users consenting to more access than they realize.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill automatically runs pip without prior consent, meaning users are not clearly warned that analyzing a file may trigger package installation and environment changes. In this context, that is more dangerous because the skill is positioned as a simple file reader/summarizer, so operators are less likely to expect networked installation behavior or review the implications before execution.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.