by 安全扫描
OpenClaw
安全
high confidenceThe skill's code and runtime instructions are coherent with its stated purpose (local HWP/HWPX/PDF text extraction), request no credentials, and have no network or unexpected persistence behaviors.
评估建议
This skill appears to do exactly what it describes: extract text from local HWP/HWPX/PDF files and save JSON output. Before installing/use, consider: (1) it may execute a local 'hwp-reader' binary or a Python interpreter from ~/.openclaw/venv — ensure those binaries are trusted (an attacker controlling the working directory or venv could cause execution of malicious code); (2) it writes <id>_extracted.json into the current directory and creates a short-lived temp script when using pyhwp; (3) OCR...详细分析 ▾
✓ 用途与能力
Name/description match the included script: the code implements a pipeline (hwp-reader -> pyhwp -> HWPX parsing -> strings) to extract text from local HWP/HWPX/PDF files. No unrelated capabilities or extra credentials are requested.
ℹ 指令范围
SKILL.md and the script restrict operations to local files and produce JSON output. The script will execute local helper binaries (hwp-reader if present), may run the provided or detected Python venv to import pyhwp, reads zip/XML inside HWPX, and calls the system 'strings' binary as a fallback. It writes <id>_extracted.json to the current working directory and creates a short-lived temp extractor script when invoking pyhwp. These behaviors are expected for this purpose but are worth noting because the skill executes local binaries and writes files.
✓ 安装机制
No install spec; this is an instruction + script bundle only. Nothing is downloaded or extracted from external URLs and no packages are installed by the skill itself.
✓ 凭证需求
The skill declares no environment variables or credentials. Runtime behavior inspects ~/.openclaw/venv and the current working directory for helper binaries, which is reasonable for locating a venv or workspace-provided hwp-reader binary.
✓ 持久化与权限
always is false and the skill does not request persistent system-wide changes or modify other skills. It writes output files to the working directory only (no system config changes).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/29
Initial release of hwp-extract-pipeline. - Provides robust extraction of text from HWP/HWPX/PDF (including scanned) files using a prioritized fallback pipeline. - Supports extraction via hwp-reader, pyhwp, OCR (poppler+tesseract), and strings as last resort. - Outputs extracted text in JSON format to stdout and as a file. - Accepts local file paths as input for automated processing. - Documentation and example usage available in scripts/README.md.
● 无害
安装命令
点击复制官方npx clawhub@latest install hwp-extract-pipeline
镜像加速npx clawhub@latest install hwp-extract-pipeline --registry https://cn.longxiaskill.com镜像同步中