by 安全扫描
OpenClaw
安全
high confidence该技能的代码、运行指令和所需的第三方工具与其声明的目的（合并ZUGFeRD发票）一致，不请求无关的凭证，也不包含隐藏的网络端点。
评估建议
该技能看似与其声明的目的一致，但在安装/使用前请注意以下预防措施：1) 仅从MustangProject官方GitHub发布页面下载mustang.jar，并验证校验和/签名（如果可用）—— 运行不可信任的JAR可以执行任意代码。2) 确保Java和GhostScript从受信任的包源（homebrew或发行版包）安装。3) 注意SKILL.md使用macOS/homebrew路径；如果您在Linux/Windows上运行，可能需要调整PATH和安装命令。4) 包含的样本XML文件包含看似真实的联系人/IBAN数据 —— 将其视为样本数据；不要意外发布它们。5) 先在测试文件上运行该技能，并在提交到B2B/Gov门户之前验证输出。6) 如果需要更高的保证，请查看mustang.jar发布的校验和或从源代码构建MustangProject。...详细分析 ▾
ℹ 用途与能力
The name/description (ZUGFeRD invoice merger) match the code and required tools: Java (mustang.jar) and GhostScript are legitimately needed for extracting/re‑embedding ZUGFeRD XML and producing PDF/A‑3. No unrelated environment variables or credentials are requested. Minor note: the SKILL.md and scripts assume a macOS/homebrew layout (/opt/homebrew/opt/openjdk@21) and recommend brew; the skill has no OS restriction declared, so platform assumptions should be documented or adjusted.
✓ 指令范围
SKILL.md and the two Python scripts only operate on user-supplied PDFs and local temporary/output paths. The runtime steps are explicit (extract XML, merge with gs, convert to PDF/A‑3, re‑embed XML with mustang). There are no instructions to read unrelated system files or to transmit data to remote endpoints. The scripts call external binaries (java, gs) with arguments; subprocess calls use argument lists (no shell interpolation).
ℹ 安装机制
No automated install spec is provided (instruction-only). The SKILL.md recommends manually downloading mustang.jar via curl from the official GitHub releases URL — a reasonable approach. Recommendation: verify the downloaded JAR (checksum/signature) because running arbitrary JARs carries risk. The manual curl direction writes into ~/.openclaw/tools/mustang which is a clear, confined location.
✓ 凭证需求
The skill requests no credentials or secret environment variables. It does modify PATH locally for the subprocess environment to include the openjdk@21 bin path (expected for invoking java). No extraneous access to other configs or sensitive data is requested.
✓ 持久化与权限
The skill is not force-included (always: false) and is user-invocable. It does create a workspace under the skill directory (temp and expected ~/.openclaw/tools paths) but does not modify other skills or system-wide agent settings. Autonomous invocation is enabled by default on the platform but is not combined with other concerning flags.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/2
Initial release: GhostScript workflow for visible pages + ZUGFeRD 2.1 compliance
● 无害
安装命令 点击复制
官方npx clawhub@latest install zugferd-invoice
镜像加速npx clawhub@latest install zugferd-invoice --registry https://cn.clawhub-mirror.com
技能文档
简介
合并ZUGFeRD 2.1标准的发票PDF和时间报告，生成单个可见的多页PDF/A-3b文件，内嵌XML，适用于德国B2B和政府用途。用法
- 安装必需的GhostScript和Java（通过homebrew或发行版包）
- 从官方GitHub下载mustang.jar，验证校验和/签名
- 运行技能，合并发票和时间报告
注意
- 样本XML文件包含示例联系人/IBAN数据，请勿公开
- 在提交到B2B/Gov门户之前，在测试文件上验证输出
# 原始YAML前置（不翻译） ...（保持原文）...
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制