Screenshot Tool

网页截图 + 文档截图工具。支持网页全页截图、PPT/Word/Excel/PDF 转高清图片。保留原始样式，300 DPI 高清输出。

This skill appears to do what it claims: webpage screenshots (via agent-browser) and document→image conversion (LibreOffice → pdf2image). Before installing or running: 1) Verify the agent-browser npm package/source (npm packages can execute code and download browser dependencies). 2) Only run the scripts on files/URLs you trust — the scripts construct shell commands with user-supplied filenames/URLs and use shell=True, which can be abused if an attacker controls the input (sanitize or avoid untrusted filenames). 3) Install system packages (LibreOffice, poppler-utils) from your OS package manager to avoid unknown binaries. If you need higher assurance, review or run the Python scripts in a sandbox and/or replace subprocess shell usage with safer invocation (list-argument subprocess.run).

Type: OpenClaw Skill Name: screenshot-tool Version: 1.0.0 The skill bundle contains critical shell injection vulnerabilities in both `scripts/doc_screenshot.py` and `scripts/web_screenshot.py` due to the use of `subprocess.run(shell=True)` with unsanitized input variables such as file paths and URLs. While these flaws allow for potential Remote Code Execution (RCE) if the agent processes untrusted input, the code logic appears consistent with the stated purpose of document and webpage screenshotting, and there is no evidence of intentional malicious behavior or data exfiltration.