Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Adobe Automator
v1.1.2Automate Photoshop, Illustrator, InDesign, Premiere Pro, and After Effects using ExtendScript (ES3) scripts executed via a cross-platform bridge.
⭐ 0· 1k·3 current·3 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the implementation: the skill accepts a target Adobe app and a JSX script, writes the script to a temp file, and invokes cscript (Windows) or osascript (macOS) to run it. No unrelated binaries, env vars, or external services are requested.
Instruction Scope
The SKILL.md and handler explicitly allow execution of arbitrary ExtendScript (ES3). That is necessary for the stated automation purpose, but ExtendScript has unrestricted filesystem access and can perform destructive or exfiltrative actions. The skill relies on the user/agent to inspect/validate scripts rather than enforcing any sandboxing or whitelisting.
Install Mechanism
No install spec — instruction-only with a small handler.js. The handler uses only standard Node.js APIs (fs, child_process, os) and spawns built-in platform script hosts. There are no downloads, external installers, or archive extraction steps.
Credentials
The skill declares no required environment variables, credentials, or config paths. It does not request unrelated secrets or system config access beyond writing temporary files and invoking system script hosts, which is proportional to its purpose.
Persistence & Privilege
always is false and model invocation is allowed by default. The skill does not modify other skills or system-wide agent settings and does not request persistent presence or elevated privileges beyond normal runtime behavior.
Assessment
This skill honestly implements an ExtendScript bridge for Adobe apps and therefore must be able to run arbitrary JSX — which has full ExtendScript filesystem access. That is coherent with the stated purpose but is high-risk: only run scripts you or a trusted party have reviewed. Practical mitigations: (1) never paste or run scripts from unknown sources; (2) run automation on an isolated machine or VM that does not contain sensitive data; (3) restrict filesystem permissions for the user account that runs Adobe; (4) maintain an allowlist of vetted scripts or require signed scripts; (5) log invocations and inspect temporary files if something looks suspicious; (6) be aware temporary files are written to the OS temp directory and the handler attempts to delete them but may leave remnants if execution fails. If you need automatic/scripted automation in an environment with sensitive data, consider additional sandboxing or a review policy before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97bdwy6dh22h1zj1zgr4g6by1814xsr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.