FormatFerry Markdown Converter
v1.1.3Convert HTML, DOCX, PDF, XLSX, CSV to Markdown
⭐ 0· 78·0 current·0 all-time
by@britrik
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (convert various document types to Markdown) lines up with the included scripts and SKILL.md. The scripts call a 'formatferry' CLI (or npx fallback) and perform conversion; no unexpected services, credentials, or unrelated binaries are requested.
Instruction Scope
SKILL.md and the scripts only describe authenticating to the FormatFerry CLI and converting either local files or URLs. The runtime instructions do not attempt to read arbitrary system files, remote endpoints other than fetched URLs, or aggregate unrelated secrets. They explicitly warn not to expose the API key and limit output to /tmp or current dir.
Install Mechanism
No registry install spec is embedded (the repo is instruction-only), but SKILL.md recommends 'npm install -g formatferry' or using npx. Installing an unvetted global npm package has known supply-chain and privilege risks; this is expected for a CLI-based tool but you should verify the npm package's trustworthiness before installing globally.
Credentials
The skill declares no required environment variables and does not request unrelated credentials. It does require the user's FormatFerry API key for authentication (auth.sh invokes 'formatferry auth --api-key ...') and notes the key is stored locally — this is proportional for a paid/locked CLI service but the user should be aware the key will persist on disk via the CLI's storage mechanism.
Persistence & Privilege
The skill is not always-enabled and does not request elevated privileges or modify other skills. Scripts write output to /tmp or a local file, and contain explicit checks to block writes to sensitive system paths. Nothing in the package attempts to escalate presence beyond its own scripts.
Assessment
This package appears coherent with its purpose, but before installing: (1) verify the npm package 'formatferry' and the homepage are trustworthy (no public repo is listed here), (2) avoid installing unknown npm packages globally unless you trust them (use npx or a container/sandbox for testing), (3) be aware you must provide an API key and the CLI will store it locally — treat that key like a password, and (4) review the upstream formatferry CLI behavior (network access, telemetry, and where it persists credentials) before using it with sensitive documents.Like a lobster shell, security has layers — review code before you run it.
batchvk97016cdtdqdkkcqx9kfka4fx184b2a3cleaningvk97016cdtdqdkkcqx9kfka4fx184b2a3clivk97016cdtdqdkkcqx9kfka4fx184b2a3conversionvk97016cdtdqdkkcqx9kfka4fx184b2a3csvvk97016cdtdqdkkcqx9kfka4fx184b2a3docxvk97016cdtdqdkkcqx9kfka4fx184b2a3filesvk97016cdtdqdkkcqx9kfka4fx184b2a3formatferryvk97016cdtdqdkkcqx9kfka4fx184b2a3htmlvk97016cdtdqdkkcqx9kfka4fx184b2a3latestvk97c8g7z5815fybzyyrqyzbdzx84b2xcmarkdownvk97016cdtdqdkkcqx9kfka4fx184b2a3offlinevk97016cdtdqdkkcqx9kfka4fx184b2a3pdfvk97016cdtdqdkkcqx9kfka4fx184b2a3productivityvk97016cdtdqdkkcqx9kfka4fx184b2a3text-processingvk97016cdtdqdkkcqx9kfka4fx184b2a3xlsxvk97016cdtdqdkkcqx9kfka4fx184b2a3
License
MIT-0
Free to use, modify, and redistribute. No attribution required.