Word Track Changes

Enable Microsoft Word's Track Changes (修订模式) on documents using native OOXML elements. Supports cross-run text matching and precise paragraph-level replaceme...

This skill appears to do exactly what it says: locally modify DOCX files by inserting OOXML <w:ins>/<w:del> elements to emulate Word Track Changes. Before installing or running: (1) back up original documents and test on non-sensitive examples to confirm correctness; (2) ensure you run the scripts in a Python 3 environment (the code uses only standard-library modules); (3) review/adjust the author/date values if needed (the processor sets them and they will appear in Word); (4) be aware that malformed or unusually-structured DOCX files may cause exceptions—review the output before distribution. No network activity or secret access is requested by the code, so the primary risk is accidental corruption of documents rather than data exfiltration.

Type: OpenClaw Skill Name: word-track-changes Version: 1.0.0 The skill bundle provides legitimate functionality for programmatically editing Word documents with native track changes. However, it is classified as suspicious due to a security vulnerability in `scripts/track_changes.py`: the `TrackChangesProcessor` class uses `zipfile.extractall()` on the input DOCX file (which is a ZIP archive) without validating the destination paths of the archive members. This exposes the system to a 'Zip Slip' vulnerability, where a specially crafted DOCX file could overwrite arbitrary files on the filesystem. The rest of the code, including the XML manipulation logic and CLI scripts, appears to be functionally aligned with the stated purpose.