智能文档处理助手

智能文档处理助手 - 一站式文档处理工具，支持 PDF 转换、智能摘要、多语言翻译、格式转换等功能。自动提取关键信息，生成结构化报告，提升文档处理效率10倍。

What to consider before installing: - Documentation mismatch: SKILL.md shows separate scripts (summarize.mjs, translate.mjs, extract.mjs) but the package contains only scripts/process.mjs which supports actions via --action. Treat the single process.mjs as the real entrypoint; the extra examples are likely stale docs but could cause confusion. - No secret access: the code does not request or read credentials or environment secrets, and it does not call external APIs for translation (translation is a placeholder). Still, inspect any later updates that add network or API calls before sending sensitive documents. - Local-only operation: pdftotext is invoked through child_process.execSync to extract PDF text; this is expected but means the binary must be present on the host. Run the tool on non-sensitive sample documents first. - Safety steps: review scripts/process.mjs locally (already provided), run in an isolated environment (container or VM), and search the repo for any network calls or hidden endpoints before processing confidential files. If translation features are important, verify which translation API the skill integrates with (if any) and ensure you consent to any external data transmission. Overall: the implementation appears coherent with its stated purpose, but the documentation inconsistencies justify caution (test in a sandbox and review code) before using on sensitive data.

Type: OpenClaw Skill Name: smart-doc-processor Version: 1.0.1 The skill contains a shell injection vulnerability in `scripts/process.mjs` where the `inputFile` argument is passed directly into a template string for `execSync` without sanitization. While the script performs legitimate document processing tasks like PDF text extraction and regex-based entity recognition, this flaw could allow arbitrary command execution if a malicious filename is provided. No evidence of intentional malice, data exfiltration, or persistence was found.