Doc Structurer

Security checks across malware telemetry and agentic risk

Overview

Prompt-injection indicators were detected in the submitted artifacts (system-prompt-override); human review is required before treating this skill as clean.

This skill looks coherent for structuring parsed documents. Before installing, confirm you trust the owner/source, use it only on intended parsed-results files, and review structured_results.json before sending results to Notion or Apple Calendar. ClawScan detected prompt-injection indicators (system-prompt-override), so this skill requires review even though the model response was benign.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI04: Agentic Supply Chain Vulnerabilities
Info
What this means

You may have less assurance about who maintains the skill or where its code came from.

Why it was flagged

The skill has limited provenance information. This is not evidence of malicious behavior, but it reduces how much a user can verify about origin and maintenance.

Skill content
Source: unknown; Homepage: none
Recommendation

Install only if you trust the registry owner, and review the full source before using it on sensitive documents.

#
ASI05: Unexpected Code Execution
Low
What this means

The skill will run Python locally and read the parsed document file you point it at.

Why it was flagged

The skill directs the agent to run a local Python script after the user supplies a parsed-results path. This is expected for a script-based document processing skill, but it is still local code execution.

Skill content
사용자가 파싱 결과 파일 경로를 알려주면... `doc_structurer.py` 스크립트를 즉시 실행하라.
Recommendation

Run it only on intended parsed-results files and inspect the output before using it in other workflows.

#
ASI06: Memory and Context Poisoning
Low
What this means

Sensitive contract, financial, organizational, or personal details from documents may be processed in model context or reflected in structured summaries.

Why it was flagged

For ambiguous documents, the workflow may place part of the document text into the model context. This is purpose-aligned, but document snippets can contain confidential or personal information.

Skill content
LLM 기반 최종 판별: ... LLM에게 문서 앞부분(500자)을 보여주고 분류 요청
Recommendation

Use the skill only with documents you are comfortable processing this way, and treat document text as data rather than instructions.

#
ASI08: Cascading Failures
Low
What this means

Incorrect extracted dates, priorities, or document summaries could become Notion records or calendar events if automatically synced later.

Why it was flagged

The skill's output is intended for downstream Notion and calendar sync workflows. If classification, dates, or priority are wrong, those errors could be persisted by later skills.

Skill content
구조화된 데이터는 `notion-sync` 스킬을 통해 Notion 데이터베이스에 저장되고, 날짜 정보가 포함된 항목은 `calendar-sync` 스킬로 Apple 캘린더에 등록된다.
Recommendation

Review the generated JSON, especially dates, deadlines, financial amounts, and action items, before passing it to sync skills.