by 安全扫描
OpenClaw
可疑
medium confidenceCode and instructions generally match a .docx processing tool, but the skill omits required runtime dependencies and contains a runtime-compiled LD_PRELOAD shim and LibreOffice macro installation — behaviors that deserve caution before installing or running.
评估建议
This skill appears to actually implement .docx/.pptx/.xlsx unpacking, editing, validation, and packing — that part is coherent. Before installing or running it, consider:
- Required tools: The skill expects LibreOffice (soffice), pandoc, pdftoppm, the docx npm package (docx-js), and gcc — but the skill metadata declares no required binaries. Ensure you only run it on machines where you trust those tools and understand they will be invoked.
- Runtime compilation & LD_PRELOAD: The soffice helper ...详细分析 ▾
ℹ 用途与能力
The name, description, SKILL.md, and included Python scripts all focus on creating, reading, editing, and validating .docx/.pptx/.xlsx files — this aligns with the stated purpose. However, the skill fails to declare several required external tools and binaries (soffice/LibreOffice, pandoc, npm docx package, pdftoppm, and gcc for the shim) even though both SKILL.md and the code expect them. That mismatch is unexpected and should be remedied or called out to users.
⚠ 指令范围
Runtime instructions (SKILL.md) and the included scripts operate on user-supplied Office files and unpacked directories (expected). But the code also: (1) writes a LibreOffice macro into a user profile directory and invokes soffice to execute it; (2) may compile and LD_PRELOAD a C shim at runtime to work around AF_UNIX socket restrictions. Both actions go beyond simple file-editing guidance and introduce behavior that affects the runtime environment and executes compiled native code.
ℹ 安装机制
There is no install spec (no external downloads), which keeps install risk low. However, the included office/soffice module generates C source into the temp directory and invokes gcc to build a shared object at runtime, then uses LD_PRELOAD. Runtime compilation/execution of native code is higher risk than pure Python/JS and should be considered carefully.
✓ 凭证需求
The skill does not request any environment variables, credentials, or external config paths in its metadata. The file operations and temp-file usage in the scripts are proportionate to document processing. Still, the skill writes to /tmp (e.g., macro profile, compiled shim) and sets LD_PRELOAD for subprocesses it launches; those are environment-affecting actions that are not reflected in the declared requirements.
ℹ 持久化与权限
always:false and no cross-skill configuration changes. The skill does create files under /tmp (a LibreOffice profile path and a compiled .so shim) and writes a LibreOffice macro into that profile; these artifacts can persist across runs until cleaned and could affect subsequent LibreOffice invocations if reused. This is not permanent system-wide installation but is more than ephemeral in-memory activity.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/21
- Initial release of docx-cn with comprehensive documentation for Word (.docx) document processing. - Supports creating, reading, and editing .docx files, including formatting, tables, and images. - Provides step-by-step guides and code samples for document generation using docx-js (JavaScript). - Covers best practices for styling, lists, tables, images, page setup, and tracked changes. - Includes command-line utilities and common troubleshooting strategies for DOCX file compatibility.
● 可疑
安装命令
点击复制官方npx clawhub@latest install docx-cn-1-0-1
镜像加速npx clawhub@latest install docx-cn-1-0-1 --registry https://cn.longxiaskill.com