printer-control

Control local and network printers on Windows to list printers, print files or text, check status, and set default printer with name matching support.

This skill appears to do what it claims (Windows printer control) but be cautious before installing or running it: - Only run these scripts on a trusted machine and with trusted inputs. The scripts interpolate printer names and file paths into PowerShell command strings without rigorous escaping; supplying untrusted or specially crafted names could lead to command injection or unexpected PowerShell behavior. - Printing operations read and send file contents and create temporary files; do not feed sensitive files to this skill unless you trust it and the environment. - Some troubleshooting steps (Restart-Service -Name Spooler) require administrative privileges — be careful granting elevated rights. - There are minor bugs/oddities (e.g., the PowerShell snippet in print_file.py attempts to change printer default via Set-Printer -Shared instead of setting Default) — review behavior before using in production. Recommendations before proceeding: 1) Inspect/run the scripts locally in a safe environment (VM) and test with non-sensitive files. 2) If you plan to integrate this into an automated agent, sanitize/validate printer and file-name inputs and avoid running with elevated privileges unless necessary. 3) Consider hardening the code by properly escaping/interpolating values when constructing PowerShell commands (or using subprocess with argument arrays and avoiding -Command with embedded strings), and by adding input validation and logging for auditability.

Type: OpenClaw Skill Name: printer-control Version: 1.0.0 The skill provides legitimate printer management functionality for Windows using pywin32 and PowerShell fallbacks. However, it is classified as suspicious due to potential command injection vulnerabilities in scripts like print_file.py, print_text.py, and set_default.py, where PowerShell commands are constructed using f-strings with insufficient sanitization of arguments such as --printer and --file. While the SKILL.md includes safety warnings, the underlying code logic allows for arbitrary command execution if an attacker can influence the input parameters passed to the scripts.