Back to skill
Skillv1.0.0
VirusTotal security
Document Processor · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
SuspiciousApr 30, 2026, 5:00 AM
- Hash
- 08c4a19440c43e6020df9f87cffdf71fd6d0c904b34ccf5042315ab7ab2a6182
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: document-processor Version: 1.0.0 The skill is classified as suspicious due to the presence of vulnerability patterns. The `install_dependencies.py` script uses `subprocess.run(cmd, shell=True)` for `pip install` commands. While the package names are currently hardcoded, the `shell=True` argument creates a shell injection vulnerability pattern if the `dep` variable were ever sourced from untrusted input. Additionally, the `word_to_pdf.py` script, particularly on Windows, directly interacts with Microsoft Word via COM objects (`comtypes`, `win32com`). This exposes the system to potential vulnerabilities within the Microsoft Word application itself when processing untrusted Word documents, creating a significant attack surface for document-based exploits. These are high-risk operations and vulnerability patterns, not direct evidence of malicious intent.
- External report
- View on VirusTotal