📦 Doc Factory — 文档工厂
v1.0.0在企鹅工厂（指挥频道）收到“生成文档”“生成PDF”等指令后，自动在目标频道上传文档并建立双向链接，同时在指挥频道回传完成通知与目标频道链接，实现文档创建与分发的闭环自动化流程。
0· 176·0 当前·0 累计
by @mupengi-bot下载技能包
最后更新
2026/3/25
安全扫描
OpenClaw
安全
medium confidenceNULL
评估建议
This skill appears to do what it says (create PDFs and post them with channel links), but before installing: 1) confirm the agent runtime has a headless Chrome available (or update the skill to declare Chrome as a required binary and provide cross-platform commands); 2) verify how the agent will authenticate to Discord (bot token or platform integration) and grant only minimal upload/post permissions to the bot; 3) check the hard-coded control channel ID (1486250338338996325) is intended and saf...详细分析 ▾
ℹ 用途与能力
The described purpose (generate documents and post them with reciprocal channel links on Discord) aligns with the instructions. However, the SKILL.md references running Google Chrome headless to produce PDFs but the skill declares no required binaries — this is a mismatch (Chrome should be listed as required). The command is macOS-specific while the skill has no OS restriction.
ℹ 指令范围
Instructions are narrowly scoped to: generate HTML → PDF using headless Chrome, upload the file to the target Discord channel, and post reciprocal channel mentions. They do not ask to read unrelated system files. They do assume the agent has the capability to upload to Discord and run Chrome, but they do not describe how authentication / permissions for Discord posting are obtained.
✓ 安装机制
Instruction-only skill with no install steps or external downloads — minimal risk from installation. Nothing will be written to disk by an installer, though the runtime workflow will create PDF files.
ℹ 凭证需求
No environment variables or credentials are declared, yet the workflow requires posting to Discord channels (which normally needs a bot token or platform-level Discord integration) and a local Chrome binary. The absence of declared credentials/binaries is an operational omission; it’s not necessarily malicious but you should confirm where the Discord posting capability and Chrome runtime come from and that only required permissions are granted.
✓ 持久化与权限
always is false and the skill is user-invocable with normal autonomous invocation allowed; it does not request persistent presence or attempt to modify other skills or system-wide settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/25
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install doc-factory
镜像加速npx clawhub@latest install doc-factory --registry https://cn.longxiaskill.com