Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Information Extraction
v1.0.0Extract structured information from unstructured text through a semi-automatic pipeline. Support entity extraction, relation extraction, attribute extraction...
⭐ 0· 71·0 current·0 all-time
by@quqxui
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name, description, and included scripts align with an information-extraction pipeline: extract.py, normalize.py, and export_triples.py implement extraction, normalization, and export. The heuristics are simple and consistent with a scaffold rather than a full production extractor. However, the pipeline's data contract is inconsistent: extract.py does not include a top-level "relations" key in its output even though normalization expects one, which will cause relations to be lost when following the documented workflow.
Instruction Scope
SKILL.md instructs running extract.py -> normalize.py -> export_triples.py, but extract.py's JSON output omits a 'relations' field (it returns triples, entities, attributes, events, ambiguities). normalize.py expects data.get('relations', []) and will therefore receive an empty list — so relations discovered by extract.py will not be preserved through normalization. Also, the usage examples reference a path (skills/information-extraction/scripts/...) while the repository layout shows scripts/..., which may cause confusion depending on installation layout. Aside from these mismatches, the instructions do not attempt to read unrelated system files, environment variables, or contact external endpoints.
Install Mechanism
This is an instruction-only skill with included Python scripts and no install spec. Nothing is downloaded from external URLs and no packages are installed by the skill itself, so filesystem and network risks from installation are minimal. The scripts use only the standard library.
Credentials
No environment variables, credentials, or config paths are requested. The scripts operate on local input text and local files only; there is no network or secret access.
Persistence & Privilege
The skill does not request always:true and does not modify system or other skills' configuration. It is user-invocable and may be invoked autonomously by the agent (platform default), which is expected for skills. There is no evidence of persistent privilege escalation.
What to consider before installing
This skill appears to implement a simple semi-automatic IE pipeline and contains only local Python scripts (no network calls or secrets). However, there are a few things to check before using it on important data:
- Bug to fix: run the extractor once and open the produced JSON. If you do not see a top-level "relations" key, relations discovered by the extractor will be lost by normalize.py. Either add 'relations' to the extractor's output or modify normalize.py to read relations from the extractor output.
- Path note: the SKILL.md usage examples use 'skills/information-extraction/scripts/...' while the files live under 'scripts/...'; ensure the runtime path matches where the skill is installed.
- Quality caution: the scripts use simple regex heuristics and low default confidences; expect false positives/negatives. Always manually review outputs (the documentation already recommends this).
- Safety: there is no network or secret access in the code, so the immediate exfiltration risk is low. Still, run the code on non-sensitive sample data first and inspect outputs. If you plan to integrate this into automated pipelines, patch the relations omission and consider improving extraction logic and confidence handling before processing high-stakes documents.Like a lobster shell, security has layers — review code before you run it.
latestvk977yr19pzj6m6tesjc8cq50x583dcxe
License
MIT-0
Free to use, modify, and redistribute. No attribution required.