Psd Automator

Automate PSD text replacement on Mac and Windows with Photoshop, dry-run safety, style-lock checks, rollback, and local PSD index cache. Use when requests in...

This skill appears to implement PSD automation, but I found multiple red flags you should address before installing or running it: 1) Missing dependency and wrapper files: The code imports 'sharp' and 'jszip' but the package metadata doesn't declare or install them; 'sharp' requires native build/runtime dependencies. Also run-task.js expects platform-specific wrapper scripts (e.g., psd-modify-mac.applescript, psd-modify-win.ps1, psd-export-png-win.ps1) but the package only includes .jsx ExtendScript files — the glue scripts appear to be missing. Verify these files and dependency installation steps with the author, and test in an isolated environment. 2) Filesystem indexing and privacy: build-index.js recursively scans roots (Desktop, Documents or whatever you pass) and writes ~/.openclaw/psd-index.json containing absolute paths and optional sidecar text metadata. Consider whether you want an index of all PSDs on the machine and any embedded sidecar text. If you run build-index, limit --root to trusted folders and inspect the generated index before using it. 3) DingTalk marker leaks absolute paths: The SKILL.md requires emitting a [DINGTALK_IMAGE] marker containing an absolute path (e.g., /Users/name/Desktop/xxx.png). That will publish local absolute paths and filenames to an external chat service. If that is unacceptable, do not enable automatic replies that publish the marker; instead require human review before posting. 4) Test and sandbox: Run the tool in a controlled VM or test account first. Ensure Node, required native modules, and system automation (osascript / PowerShell + Photoshop automation) are correctly installed. Review and, if necessary, implement or supply the missing wrapper scripts so you know exactly what commands will run. If you cannot verify the missing wrappers and dependency installation, treat the package as incomplete/untrusted and do not run it on production machines holding sensitive data.

Type: OpenClaw Skill Name: psd-automator Version: 1.0.2 The skill bundle provides extensive automation for Adobe Photoshop on macOS and Windows, utilizing high-risk capabilities such as system-level execution (osascript, powershell) and broad filesystem access. While the logic aligns with the stated purpose of PSD text replacement, the implementation in 'run-task.js' and the associated ExtendScript files (.jsx) creates a significant attack surface for command or script injection if user-provided layer names or text are not strictly sanitized. Additionally, the 'DingTalk' integration requires the agent to output absolute file paths in a specific format, which could be leveraged for data exfiltration if the agent is prompted to process sensitive files outside the intended design directories.