将中文需求快速改写并排版为哈佛格式论文（含摘要、关键词、目录、分级标题、参考文献），并导出 .docx。用户提到“写论文、哈佛格式、学术润色、生成Word论文、参考文献Harvard”时使用。

This skill appears coherent and implements what it claims: it formats user-provided material into a Harvard‑style .docx using the included shell script. Before using it, note: (1) The script requires pandoc but the registry metadata does not list that — install pandoc locally before running. (2) You must provide a path to an input text/markdown file; the script will read whatever file path you pass, so avoid supplying paths to sensitive system files. (3) Review generated content for accuracy, citation correctness, and academic‑integrity concerns (the tool can produce plausible text but may need fact‑checking). (4) Inspect scripts/make_harvard_paper.sh yourself if you have doubts (it is short and readable). If you want to run this in an environment without pandoc or without direct filesystem access, consider having the skill accept raw text instead of a file path or run it locally where you control inputs and outputs.

Type: OpenClaw Skill Name: harvard-paper-zh Version: 0.1.0 The `scripts/make_harvard_paper.sh` script is vulnerable to arbitrary file read and write. It directly uses user-provided paths for the input source (`$SOURCE`) and output document (`$OUT_DOCX`) without any sanitization or validation. This means a malicious prompt to the AI agent could instruct it to read sensitive files (e.g., `/etc/passwd`) and include their content in the generated document, or to write the output `.docx` to arbitrary locations on the filesystem, potentially overwriting critical system files. While these are critical vulnerabilities that could lead to information disclosure or system compromise, there is no clear evidence of intentional malicious behavior such as data exfiltration, persistence, or remote control within the provided files.