docx

Comprehensive document creation, editing, and analysis with support for tracked changes, comments, formatting preservation, and text extraction. When Claude...

This skill appears to implement .docx unpack/pack/validation and contains readable source code you can audit — that's a positive. Before installing or using it: (1) Review the bundled Python scripts (they are provided) to confirm you are comfortable with the subprocess calls (they call soffice and git) and local file reads/writes. (2) Verify and install required external tools the SKILL.md expects (pandoc, libreoffice/soffice, git, Node + docx npm package), since none are declared. (3) Be aware of the restrictive LICENSE.txt (proprietary, limits extracting/retaining materials) — ensure your intended use and storing of skill files complies with it. (4) Note the validator is hardcoded to look for tracked changes authored by 'Claude' — behavior may differ if you run a different agent. (5) Test the skill on non-sensitive documents in a sandbox first. If you need this in a production environment, either confirm the declared dependencies and integrate an install step or perform a security/legal review first.

Type: OpenClaw Skill Name: organize-messy-files-docx Version: 0.1.0 The skill bundle provides a comprehensive toolkit for DOCX manipulation but contains several high-risk vulnerabilities and aggressive agent-steering instructions. Specifically, ooxml/scripts/unpack.py uses zipfile.extractall(), which is vulnerable to Zip Slip (arbitrary file write), and ooxml/scripts/validation/base.py utilizes lxml.etree.parse() without explicit protections against XML External Entity (XXE) attacks. Furthermore, SKILL.md employs prompt-injection-style 'meta-instructions' (e.g., 'MANDATORY - READ ENTIRE FILE', 'NEVER set any range limits') to override the agent's default behavior, which, while likely intended for context preservation, represents an attack surface for controlling agent execution.