Superdoc
Security checks across malware telemetry and agentic risk
Overview
The skill is a straightforward DOCX editing guide with normal local file and npm setup actions, and the artifacts do not show hidden credentials, persistence, exfiltration, or destructive behavior.
This appears reasonable for a DOCX manipulation skill. Before using it, verify the SuperDoc npm package/source, consider pinning dependency versions, and make sure the agent only reads and writes document paths you approve.
VirusTotal
66/66 vendors flagged this skill as clean.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill may help an agent read and modify local document files during a DOCX task.
The skill demonstrates local file reads and writes for editing DOCX files. This fits the stated purpose, but file-writing examples can overwrite or create files if paths are not user-controlled.
const buffer = fs.readFileSync('input.docx'); ... fs.writeFileSync('output.docx', output);Use explicit user-approved input and output paths, keep backups of important documents, and confirm before overwriting existing files.
If the setup command is run, external packages will be installed and used for document processing.
The skill documents a user-run global npm installation for dependencies rather than bundling code or an install spec. This is expected for an instruction-only integration, but it means runtime code comes from external npm packages.
npm install --global superdoc jsdom
Verify the npm packages and source repository, prefer pinned versions, and install in a project or isolated environment instead of globally when possible.