wps_office_auto_skill

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a local office-document automation skill with no artifact evidence of credential use, networking, persistence, or exfiltration, but users should verify dependencies and review processed documents carefully.

This skill looks appropriate for local office automation. Before installing, verify the Python dependency source and versions. When using it, provide only documents you intend to process, keep backups, and carefully review generated or converted files—especially contracts, financial spreadsheets, and PDFs—before relying on them.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If used on the wrong file or with incorrect parameters, the user could receive altered documents, converted files, or extracted content that should not be blindly trusted.

Why it was flagged

The skill is designed to transform and generate office files, including batch PDF operations. This is purpose-aligned, but it means the agent may process or produce important business documents.

Skill content
支持文档、表格、演示、PDF的全格式智能处理 ... 批量处理:合并/拆分/水印
Recommendation

Only provide files you intend to process, keep backups of originals, and review generated contracts, spreadsheets, presentations, and PDFs before using or sharing them.

What this means

Running the skill may depend on Python packages whose exact installation path or versions should be verified by the user or platform.

Why it was flagged

The artifact set also lists Python source files and office-processing dependencies, so the absence of a clear install spec leaves dependency installation and provenance less explicit. This is a setup transparency note, not evidence of hidden behavior.

Skill content
No install spec — this is an instruction-only skill.
Recommendation

Review requirements.txt/setup.py before installation, install dependencies from trusted package indexes, and use pinned or locked dependency versions in sensitive environments.