Wps Skill

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a disclosed WPS Office automation skill, but it can automate the local GUI, batch-handle documents, and optionally use WPS 365 credentials.

This skill is reasonable for WPS Office automation. Before installing, make sure you trust the local desktop environment, understand that GUI automation can type into the active window, review any batch file operation before running it, and only configure WPS 365 credentials if you need the cloud features.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If used while another app is focused, the agent could type document content into an unintended window.

Why it was flagged

The skill explicitly discloses that it can simulate keyboard input into the currently active window, which is expected for GUI office automation but can affect the wrong window if focus changes.

Skill content
GUI 自动化:本 Skill 使用 `pyautogui` 进行键盘输入模拟,可能会与当前活动窗口交互
Recommendation

Use this skill only in a trusted desktop session, keep WPS focused during GUI automation, and review actions before allowing document creation or editing.

What this means

Configured credentials could allow the skill to access or manage WPS 365 resources within the permissions granted to the WPS application.

Why it was flagged

The skill can use WPS Open Platform credentials for WPS 365 cloud features; this is purpose-aligned and disclosed, but it grants access to a cloud account or app context.

Skill content
WPS 365 功能需要配置 `app_id` 和 `app_secret`
Recommendation

Use least-privilege WPS app credentials, avoid shared machines, rotate secrets periodically, and leave the credentials blank if cloud features are not needed.

What this means

Future dependency versions could behave differently from the versions the author tested.

Why it was flagged

The documented setup installs third-party Python packages without version pins; these packages are relevant to the skill, but unpinned installs can change over time.

Skill content
pip install requests pyautogui pyperclip Pillow
Recommendation

Install dependencies from trusted package sources and consider pinning known-good versions in a controlled environment.

NoteHigh Confidence
ASI08: Cascading Failures
What this means

A mistaken directory or format choice could create or alter many files at once.

Why it was flagged

The skill supports batch conversion across a directory, which is aligned with its purpose but can affect many local documents in one operation.

Skill content
python scripts/main.py batch_convert dir=~/Documents format=pdf
Recommendation

Run batch operations on a small test folder first and keep backups of important documents.