Build repeatable data-to-Docs pipelines from Sheets and Drive sources. Use for automated status reports, template-based document assembly, and scheduled publ...

This skill appears to be a safe, local 'pipeline spec' composer rather than an executor that connects to Google services. Before installing/running: (1) Understand it only reads a JSON input file you provide and writes an artifact to the output path — it will not automatically read your Google Sheets/Drive or publish documents. (2) Verify the input file and output path you pass are correct and from trusted sources; the script limits input size but will process whatever JSON you give it. (3) If you expect automatic publishing to Google Docs/Drive, additional code and credentials would be required — review or add those integrations separately and only grant third-party credentials when necessary. (4) As with any code, inspect bundled scripts (scripts/compose_docs_pipeline.py) before executing in sensitive environments.

Type: OpenClaw Skill Name: docs-pipeline-automation Version: 0.1.0 The skill bundle is classified as suspicious due to potential local file read/write vulnerabilities in `scripts/compose_docs_pipeline.py`. The script accepts `--input` and `--output` file paths, which, if controlled by an attacker (e.g., via prompt injection to the AI agent), could allow reading of arbitrary JSON files or writing structured data (JSON, MD, CSV) to arbitrary locations on the filesystem. While the script does not execute arbitrary code or exfiltrate data, these capabilities present a risk for information disclosure or file manipulation. The `SKILL.md` instructions themselves do not exhibit malicious prompt injection attempts.