word-to-pdf

• Analyzed: May 11, 2026, 4:49 AM
• Findings: 0
• Version: 1.0.0
• Hash: 4c3bb19ad905f9e50d83607432747c89cdffab144d7a717c3f7cf7ee5a4ecb73
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: word-to-pdf Version: 1.0.0 The skill bundle is benign. The `SKILL.md` provides clear, standard instructions for converting Word documents to PDF and does not contain any prompt injection attempts. The `word-to-pdf.py` script uses `python-docx` and `reportlab` as expected, with its file system interactions limited to reading the specified input Word document, writing the output PDF, and legitimately searching standard system directories for Chinese fonts. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or any other harmful behavior.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI04: Agentic Supply Chain Vulnerabilities

Note

What this means

Installing unexpected or compromised dependency versions could affect the user's local Python environment.

Why it was flagged

The skill asks users to install third-party Python packages without pinned versions. These dependencies are central to the converter and no remote install script is shown, but package provenance still matters.

Skill content

pip install reportlab python-docx

Recommendation

Install dependencies from trusted package indexes, consider pinning known-good versions, and use a virtual environment.