Wps Skill

Automate WPS Office tasks including document creation, opening, format conversion, batch processing, and managing WPS 365 smart forms, docs, sheets, flowchar...

Install only if you are comfortable letting an agent create/open/convert files and control your desktop. Keep WPS focused during content entry, avoid broad batch directories, leave WPS 365 credentials blank unless needed, and treat generic document requests cautiously because the trigger patterns are broad.

Type: OpenClaw Skill Name: wps-office Version: 1.0.1 The skill provides legitimate WPS Office automation but contains several critical vulnerabilities due to insufficient input sanitization. Specifically, the `scripts/main.py` directly uses `sys.argv` parameters like `content` for `pyautogui.typewrite`, which can lead to arbitrary command execution if an attacker can control the AI agent's prompt and a terminal is active. Furthermore, `filepath` and `directory` parameters are passed to `subprocess.Popen` and `os.path.expanduser`/`os.listdir` without robust validation, posing shell injection and path traversal risks. The WPS 365 cloud API controllers also pass user-controlled arguments (e.g., `endpoint`, `data`, `filters`) directly to `requests` calls, enabling potential API abuse or server-side request forgery (SSRF) against `open.wps.cn` using the user's configured `app_id` and `app_secret`. While the `SKILL.md` transparently warns about GUI automation risks, the code lacks safeguards against malicious input, making the skill highly susceptible to prompt injection attacks against the AI agent.