The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The check_deps.py script identifies and attempts to install multiple Python packages including python-docx, pandas, openpyxl, pdfplumber, reportlab, and pypdf2 using pip install through a subprocess call.
[COMMAND_EXECUTION]: The skill executes external system commands using subprocess. In document_hub.py, it calls ffmpeg for extracting audio from video files and soffice (LibreOffice) for converting Word documents to PDF.
[DYNAMIC_EXECUTION]: The skill employs dynamic module loading techniques. The check_deps.py file uses __import__ to check for dependency availability, while document_hub.py utilizes importlib.util to load external modules (feishu-doc-creator and feishu-doc-converter) from relative file system paths.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by reading content from Word, Excel, PDF, and Markdown files. This processing creates a vulnerability surface where malicious instructions embedded in documents could influence agent behavior at runtime. The skill lacks explicit sanitization or boundary markers for this parsed content. Ingestion occurs in _read_word, _read_excel, _read_pdf, and _read_markdown functions within document_hub.py, while capabilities include writing files, converting documents, and transcribing media.
[DATA_EXPOSURE]: Absolute file paths (/Users/delta/.openclaw/workspace) are hardcoded in document_hub.py and examples.py, potentially revealing internal directory structures and user information from the development environment.

document-hub