Windows Print

• Analyzed: May 11, 2026, 6:44 AM
• Findings: 0
• Version: 1.0.0
• Hash: b8f1b676d4fcaf3d48b6b55fd7d125c847ce41a0168f23fe0f95e9e9ed3da549
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: windows-print Version: 1.0.0 The skill provides legitimate Windows printing functionality using PowerShell. It includes strong defensive instructions in SKILL.md to prevent accidental or malicious printing triggered by document content (prompt injection defense) and uses standard Windows verbs (Print/PrintTo) via Start-Process in scripts/Invoke-WindowsPrint.ps1.txt. While it uses a ScriptBlock execution method to bypass file-type restrictions for .ps1 files, the underlying logic is transparent and lacks any indicators of data exfiltration or unauthorized access.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

Note

What this means

A sensitive document could print on the default printer instead of the printer the user named, consuming paper/ink or exposing the document in the wrong location.

Why it was flagged

If printing to a specified printer fails, the script automatically tries the default printer. This is disclosed in SKILL.md and is purpose-aligned, but it could send a document to a different physical printer than the user expected.

Skill content

Write-Warning "PrintTo failed for '$file' with printer '$PrinterName'. Falling back to default printer (Verb=Print)."
        Start-Process -FilePath $file -Verb Print -ErrorAction Stop | Out-Null

Recommendation

Before using this skill for sensitive files, make sure the default printer is acceptable, or change the script to stop and ask before falling back.

ASI05: Unexpected Code Execution

Note

What this means

Using the skill will run local PowerShell commands to list printers or submit print jobs.

Why it was flagged

The skill runs local PowerShell from bundled text files. The behavior is clearly disclosed and necessary for Windows printing, but it is still local command execution.

Skill content

PowerShell scripts are stored as **`.ps1.txt`** and executed via `ScriptBlock`.

Recommendation

Use it only when you explicitly want to print, and review the included scripts if you are concerned about local command execution.