Read Microsoft Word documents (.docx and .doc) with Chinese support

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it claims: locally read Word documents, search text, and optionally save extracted text, with no evidence of network access, credential use, persistence, or hidden behavior.

This looks like a straightforward local document reader. Before installing, confirm you are comfortable letting your agent read the Word files you provide, be careful with output paths, and consider pinning dependency versions if you need a controlled setup.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI02: Tool Misuse and Exploitation
Info
What this means

The agent can read the contents of Word files you point it at and can save extracted text where instructed.

Why it was flagged

The tool accepts a local input path and optional output path, allowing it to read user-specified Word documents and save extracted text. This matches the skill purpose and is disclosed, but it is still local file access that users should understand.

Skill content
parser.add_argument('filepath', help='Word文档路径')
parser.add_argument('--output', '-o', help='输出文本文件路径')
Recommendation

Use the skill only with documents and output locations you intend the agent to access.

#
ASI04: Agentic Supply Chain Vulnerabilities
Low
What this means

Installing later dependency versions could change behavior if those packages update.

Why it was flagged

The skill depends on external PyPI packages with lower-bound constraints rather than exact pinned versions. The dependencies are directly relevant to reading Word/OLE files, but version drift can affect reproducibility.

Skill content
python-docx>=0.8.11
olefile>=0.46
Recommendation

Install dependencies from trusted package sources; pin exact versions if you need deterministic or audited installations.