Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

invoice-merger

v1.0.5

合并发票文件。PDF 按两两上下排版,图片按四宫格排版,统一裁剪线与安全边距,输出到 YYYYMMDD--已合并 目录,重复执行会自动跳过历史合并文件并按编号继续生成。

0· 152·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for cdk1025/invoice-merger.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "invoice-merger" (cdk1025/invoice-merger) from ClawHub.
Skill page: https://clawhub.ai/cdk1025/invoice-merger
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install invoice-merger

ClawHub CLI

Package manager switcher

npx clawhub@latest install invoice-merger
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (invoice merging) align with the included Python script which uses pypdf and Pillow to merge PDFs/images. However, SKILL.md's install commands reference a different package owner/slug (cdk1025/invoice-merger) than the registry owner id presented (kn76tcc5...), which is an inconsistency worth checking (likely copy/paste or packaging mismatch).
Instruction Scope
SKILL.md and the script restrict activity to local file-system processing of PDFs and images in the given directory and explicitly skip previously generated merged files. The script will open the generated output using the system default opener (via subprocess), and it processes any directory the user supplies — so avoid pointing it at system or sensitive directories. No instructions or code attempt network access or read environment variables.
Install Mechanism
No install spec is included in the registry metadata; the skill is delivered with a Python script and the README recommends installing only pypdf and Pillow via pip. The SKILL.md mentions optional npx/ClawHub install paths (which refer to a different slug/owner); this is a documentation inconsistency but the actual code is local and requires only standard Python packages.
Credentials
The skill requests no environment variables, no credentials, and no config paths. The code imports only pypdf and Pillow and otherwise operates on local files — the requested capabilities are proportionate to the stated purpose.
Persistence & Privilege
The skill does not demand always: true and does not modify other skills or global agent settings. It runs on-demand and does not persist credentials or change system-wide configuration. The script will create an output folder in the input directory as described.
What to consider before installing
What to check before installing/ running: - Verify origin: the registry owner id (kn76t...) does not match the slug used in the README/install examples (cdk1025). Confirm you have the correct package/source before running install commands that fetch remote code. - Inspect the script (scripts/merge_invoices.py) yourself — it's short and readable; it only uses pypdf and Pillow and operates on files in the directory you pass. Make sure you trust the script copy you will execute. - Run in a safe/test directory first (not system folders or directories containing secrets). The tool processes any directory you point it at and will create/modify files there. - The script will automatically open the generated PDF using the system default viewer (uses subprocess). If you prefer not to auto-open outputs, edit/remove that behavior before running. - Use a Python virtual environment and install dependencies locally (python -m venv .venv; source .venv/bin/activate; pip install pypdf Pillow). - If you want higher assurance, run the script offline (no network) and audit the remainder of the truncated code path to confirm there are no hidden network calls or unexpected behavior.

Like a lobster shell, security has layers — review code before you run it.

latestvk9789pd6tb2h66fbfav9k9xd0983pgss
152downloads
0stars
6versions
Updated 1mo ago
v1.0.5
MIT-0

Invoice Merger - 发票合并工具

将一批发票文件快速整理成可打印 PDF,省纸、省时、省心。

  • PDF:每页上下放 2 个输入文件
  • 图片:每页按 2x2 布局放 4 张图
  • PDF 和图片使用统一的裁剪线样式与安全边距

功能说明

1. PDF 合并

  • 两两合并:上下结构,每页放 2 个 PDF
  • 边距:页面外边距 15pt,中线两侧各预留 15pt 安全区
  • 取页规则:每个输入 PDF 仅取第一页
  • 缩放规则:按 A4 半页安全区自动缩放,发票高度不一致时也会统一适配
  • 裁剪线:上下半页中间增加统一样式的虚线裁剪线

2. 图片合并

  • 四个合并:两行两列布局(上半页 1-2,下半页 3-4)
  • 奇数处理:剩余 1-3 张保持布局,不复制自己
  • 缩放规则:按比例缩放并居中
  • 安全区:内容不会压到中间裁剪线
  • 裁剪线:上下半页中间增加统一样式的虚线裁剪线

输出

  • 位置:默认输出到输入目录下 YYYYMMDD--已合并
  • 命名:PDF 合并优先 发票合并.pdf,图片合并优先 账单合并.pdf,重名时自动追加序号
  • 幂等规则
    • 自动跳过历史生成的 发票合并*.pdf账单合并*.pdf
    • 同一天重复执行会复用已有输出目录
    • 如果传入目录本身就是 YYYYMMDD--已合并,会直接在该目录下继续按编号生成
  • 自动打开预览

触发场景

  • 用户说「合并发票」「把发票拼一起」「发票批量排版」
  • 用户要把一批 PDF/JPG/JPEG/PNG 发票合并成可打印 PDF

安装与使用

在 OpenClaw 中使用(推荐)

支持 OpenClaw 系列产品(如 WorkBuddy、QClaw)。

1. 通过本地路径

  • WorkBuddy 直接导入技能即可
  • 将源码文件夹拖入 QClaw 对话窗口

2. 通过 ClawHub 安装

需要安装 nodejs

npx clawhub@latest install cdk1025/invoice-merger

3. 通过 skills 安装

需要安装 nodejs

npx skills add cdk1025/invoice-merger --path invoice-merger

首次使用需安装依赖

在 OpenClaw 中通常让 AI 自己处理即可。

脚本当前实际使用的第三方依赖只有 pypdfPillow(导入名为 PIL)。

如果你是命令行手动运行,可执行:

python -m pip install pypdf Pillow

命令行使用

适合开发者或没有 OpenClaw 产品的用户。

python3 ~/.qclaw/skills/invoice-merger/scripts/merge_invoices.py <目录路径>

注意事项

  • PDF 只取每个输入文件的第一页参与排版
  • 输出目录按日期创建,重复执行会复用同名目录
  • 为避免二次缩版,脚本不会再次处理自己历史生成的合并 PDF
  • 生成后会按系统默认程序自动打开本次输出文件(macOS / Windows / Linux)

Comments

Loading comments...