work work

Academic review writer and formatting assistant for Chinese academic papers. Use this skill when users need to format, check, and refine academic literature...

This package appears to do what it says (format/check/generate Word docs for Chinese academic papers). Before running: 1) Back up your markdown files — some scripts (extract_and_fix_references.py, filter_references.py) modify source files in place. 2) Inspect scripts if you have low trust (they are plain Python/JS and readable). 3) Be aware Node scripts may call the OS to open generated docs (create_word_with_superscript.js uses child_process.exec to run start/open/xdg-open); avoid running on untrusted filenames or as a privileged user. 4) Install Python/Node dependencies in an isolated environment (virtualenv, npm install) rather than system-wide. 5) If you want extra safety, run the checkers (which only read files) first and avoid the modules that modify files or auto-open them.

Type: OpenClaw Skill Name: work-work Version: 3.3.0 The skill bundle provides a comprehensive set of academic formatting tools, but it contains a command injection vulnerability. Specifically, the scripts `create_word_with_superscript.js` and `literature_integrity_checker_auto_open.py` use potentially dangerous system calls (`child_process.exec` and `subprocess.call`) to automatically open generated Word documents. Because the filenames are derived from user-provided input without adequate sanitization, an attacker could potentially execute arbitrary commands. While the tool's overall behavior and its use of the Crossref API for reference validation appear consistent with its stated academic purpose, the high-risk nature of these unsanitized system calls necessitates a suspicious classification.