large-document-reader

• Analyzed: May 11, 2026, 4:53 AM
• Findings: 1
• Version: 1.0.2
• Hash: 4ae03fc0302ab5bd77877a8002d922027897829296c28dad16540de48aa006af
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to critical vulnerabilities in the Python scripts. Both `scripts/extract_chapters.py` and `scripts/save_chapters.py` contain hardcoded absolute file paths (e.g., `/Users/chenkuan/Desktop/毕业论文/...` and `/Users/chenkuan/.openclaw/workspace/...`). While there is no evidence of malicious intent like data exfiltration or unauthorized execution, these hardcoded paths make the skill non-portable and non-functional outside a specific developer's environment. This represents a significant design flaw and a potential security vulnerability if the agent's execution environment is not strictly sandboxed or if these paths could be manipulated by an attacker.