bot File Processor

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a local file renaming and conversion skill, but users should review file-changing actions and the odd dependency/cost wording before use.

This skill looks suitable for local file renaming and format conversion. Before using it, run dry-run/previews where available, back up important files, avoid broad sensitive folders unless necessary, and verify dependency install commands rather than installing unrelated packages blindly.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If used on the wrong folder or with the wrong rename rule, files may be renamed in a way that is difficult to undo.

Why it was flagged

The script can perform batch local file renames after confirmation. This is central to the skill's purpose, but it is still a file-mutating operation that can be hard to reverse.

Skill content

if confirm.lower() == 'y':
    for old_path, new_path in self.rename_operations:
        old_path.rename(new_path)

Recommendation

Use dry-run mode first, review the preview carefully, and back up important files before confirming batch operations.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing unnecessary packages can expand the local environment's supply-chain exposure, even though this is not automatically executed by the skill.

Why it was flagged

The documentation includes unpinned package installation instructions for Tencent Cloud/COS SDKs, while the provided scripts appear to use local file-processing libraries instead.

Skill content

pip install tencentcloud-sdk-python cos-python-sdk-v5

Recommendation

Install only the libraries actually needed for the requested conversion task, and verify package names and versions before running pip install commands.

Info

#ASI09: Human-Agent Trust Exploitation

What this means

The cost warning may confuse users about whether the skill is local-only or uses paid external services.

Why it was flagged

The documentation warns about cloud/service fees and mentions processing services, but the reviewed scripts show local file renaming/conversion behavior with no cloud API calls.

Skill content

本 Skill 调用服务会产生相应费用，包括转码费、AI 处理费、存储费等

Recommendation

Clarify whether any paid cloud service is actually involved before approving installs, uploads, or repeated processing requests.