Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
ofd-text-extractor
v1.0.1本技能用于从 OFD 格式文件中提取文本内容,并保留位置信息。 触发场景包括:分析 OFD 发票内容、从 OFD 文件中提取特定位置的信息、 或需要了解 OFD 文件的详细结构时使用。
⭐ 0· 64·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (extract text+positions from OFD) matches the included Python script: it reads a local .ofd (ZIP), parses XML/Content.xml and template pages, and computes character positions. No unrelated binaries, credentials, or services are requested.
Instruction Scope
SKILL.md instructs running scripts and describes an output JSON schema that differs from what extract_ofd.py actually writes. SKILL.md examples also show a PowerShell wrapper (scripts/extract_ofd.ps1) which is not present in the package. These mismatches could lead to broken automation or unexpected outputs.
Install Mechanism
No install spec; runtime is an included Python script with only standard-library imports. No external downloads or package installs are requested.
Credentials
The skill declares no environment variables, credentials, or config paths. The script operates on a user-supplied local OFD file only.
Persistence & Privilege
Skill does not request 'always' or any elevated/persistent privileges. It does not modify other skills or system config. Autonomous invocation is allowed (platform default) but not combined with other concerning requests.
What to consider before installing
What to check before installing/using:
- Functional checks: The included Python script appears safe and runs locally (no network/credential access). Run it on a sample OFD to confirm it produces the JSON fields you need. Note: the script writes pages with separate pageTexts and templateTexts fields, whereas SKILL.md's sample JSON shows a combined texts array with isTemplate flags — adapt your consumers accordingly.
- Missing file: SKILL.md shows a PowerShell wrapper scripts/extract_ofd.ps1, but that file is not included. Use python scripts/extract_ofd.py ... directly or create your own wrapper.
- Robustness: the script uses regular expressions to parse XML in places (fragile for edge cases). If you rely on exact extraction (invoices, automated pipelines), test with representative OFD files and consider improving XML parsing for complex inputs.
- Safety: there is no obvious exfiltration (no network/socket modules, no external calls). Still review or run in an isolated environment if processing untrusted files, and verify outputs before feeding results into downstream automated systems.
If you want, I can: (a) show the exact JSON structure the script emits for a sample OFD, (b) propose a small patch to make the output match SKILL.md, or (c) add a simple PowerShell wrapper compatible with the docs.Like a lobster shell, security has layers — review code before you run it.
latestvk97f3cfg969zre3r7j8r4dyekd84d1tb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
