OpenCC

Chinese character conversion between Simplified/Traditional and regional variants. Use when Pi needs to convert Chinese text with precision and awareness of...

This skill appears coherent and purely focused on Chinese character conversion, but before installing you should: 1) Verify which opencc package you'll install (pip package name and maintainer) and pin a known-good version — malicious or typo-squatted PyPI packages are possible. 2) Confirm the opencc package you install provides the expected JSON mode files (s2t.json, s2tw.json, etc.) or supply them from a trusted OpenCC release. 3) If you require production or high-assurance use, audit the installed opencc package (check for native code, post-install hooks, and network behavior) and run the included tests (pytest test_convert.py). 4) No secrets or network endpoints are present in the skill itself, but keep general supply-chain caution for third-party dependencies.

Type: OpenClaw Skill Name: opencc Version: 1.0.0 The `scripts/convert.py` file is vulnerable to path traversal. The `--input` and `--output` arguments are directly used in `open()` calls without sanitization, allowing an attacker to read or write to arbitrary file paths (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) on the system if the agent is instructed to use this skill with malicious input. This constitutes a significant file system access vulnerability, though it does not show clear evidence of intentional malicious behavior by the skill itself.