pandoc-docx

支持使用 pandoc 在 Word (.docx) 与 Markdown 及多种格式之间进行双向转换，保留主要格式和图片。

This skill appears to do what it says: local document conversions using pandoc and optional local tools (libreoffice, pdftotext, texlive). It does not request credentials or contact external servers. Before using: 1) run ./scripts/check-deps.sh to verify required tools are installed; 2) review the scripts if you will convert sensitive documents (doc-edit's replace uses sed without escaping and could alter content unexpectedly); 3) keep backups of original files before running bulk/replace operations; 4) note the package.json metadata is a bit misleading (lists system packages and Node engines) but that is a packaging issue, not a network/credential risk. If you want extra caution, run the scripts in an isolated environment or a disposable VM/container.

Type: OpenClaw Skill Name: pandoc-docx Version: 1.0.0 The skill bundle provides document conversion utilities using pandoc but contains significant command injection vulnerabilities due to improper input sanitization. Specifically, `scripts/doc-edit.sh` uses unsanitized variables in a `sed` command, which can be exploited for remote code execution (RCE) via the `e` flag. Additionally, `scripts/doc-read.sh` and `scripts/doc-write.sh` pass format arguments directly to `pandoc`, which could allow for argument injection. While these appear to be unintentional security flaws rather than deliberate malware, they pose a high risk to the environment.