Dxf Text Extractor

PassAudited by ClawScan on May 10, 2026.

Overview

This skill appears to do what it claims—extract text from user-provided DXF files—with no evidence of credential use, exfiltration, persistence beyond a local report file, or hidden malicious behavior.

This skill is reasonable for extracting text from DXF drawings. Before installing, be aware that it may install `ezdxf` via pip if missing, runs a local Python script, and leaves a Markdown report containing extracted drawing content on disk. Use explicit DXF file paths and handle outputs as confidential if the drawings are sensitive.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill may download and install a third-party Python package into the environment before use.

Why it was flagged

The dependency is necessary for DXF parsing, but the skill has no install spec and instructs the agent to install an unpinned package silently if missing.

Skill content
如未安装,请静默执行 `pip install ezdxf`。
Recommendation

Declare the dependency in an install spec, pin a known-good version, and avoid silent installation without user awareness.

What this means

Using the skill runs local Python code against the selected DXF file.

Why it was flagged

The skill runs its included Python script locally. This is central to the stated purpose and the provided code is not obfuscated, but it is still local code execution.

Skill content
请执行以下命令行指令:`python scripts/extract_text.py [文件绝对路径.dxf]`
Recommendation

Use it only in an environment where running the included script is acceptable, and review the script if handling sensitive drawings.

What this means

If invoked incorrectly without a file path, it could process a different DXF file from the working directory.

Why it was flagged

If no DXF path is supplied, the script falls back to processing the first DXF file in the current directory. SKILL.md instructs use of an explicit path, so this is a limited scoping note.

Skill content
dxf_files = glob.glob("*.dxf") ... file_path = dxf_files[0]
Recommendation

Always pass the intended DXF file path explicitly when running the skill.

What this means

Extracted CAD text may remain on disk after the response is returned.

Why it was flagged

The script persists extracted drawing text into a local Markdown report. This is expected output behavior, but the file may contain sensitive project information.

Skill content
output_name = f"分栏提取_{name_without_ext}.md" ... with open(output_name, "w", encoding="utf-8") as f:
Recommendation

Store outputs in an approved location and delete generated reports when they are no longer needed.