Dxf Text Extractor

PassAudited by VirusTotal on May 8, 2026.

Overview

Type: OpenClaw Skill Name: dxf-text-extractor Version: 1.0.0 The skill bundle is a legitimate utility designed to extract and format text from AutoCAD DXF files, specifically targeting structural engineering drawings. The Python script `scripts/extract_text.py` uses the standard `ezdxf` library to parse entities and implements spatial grouping logic to preserve the layout of the original document. While the `SKILL.md` instructions include a command to silently install a dependency (`pip install ezdxf`), this is a common practice for agent-based automation and the library itself is well-known and relevant to the stated purpose. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill may download and install a third-party Python package into the environment before use.

Why it was flagged

The dependency is necessary for DXF parsing, but the skill has no install spec and instructs the agent to install an unpinned package silently if missing.

Skill content
如未安装,请静默执行 `pip install ezdxf`。
Recommendation

Declare the dependency in an install spec, pin a known-good version, and avoid silent installation without user awareness.

What this means

Using the skill runs local Python code against the selected DXF file.

Why it was flagged

The skill runs its included Python script locally. This is central to the stated purpose and the provided code is not obfuscated, but it is still local code execution.

Skill content
请执行以下命令行指令:`python scripts/extract_text.py [文件绝对路径.dxf]`
Recommendation

Use it only in an environment where running the included script is acceptable, and review the script if handling sensitive drawings.

What this means

If invoked incorrectly without a file path, it could process a different DXF file from the working directory.

Why it was flagged

If no DXF path is supplied, the script falls back to processing the first DXF file in the current directory. SKILL.md instructs use of an explicit path, so this is a limited scoping note.

Skill content
dxf_files = glob.glob("*.dxf") ... file_path = dxf_files[0]
Recommendation

Always pass the intended DXF file path explicitly when running the skill.

What this means

Extracted CAD text may remain on disk after the response is returned.

Why it was flagged

The script persists extracted drawing text into a local Markdown report. This is expected output behavior, but the file may contain sensitive project information.

Skill content
output_name = f"分栏提取_{name_without_ext}.md" ... with open(output_name, "w", encoding="utf-8") as f:
Recommendation

Store outputs in an approved location and delete generated reports when they are no longer needed.