MD2DOC 文档转换器
v1.0.1Markdown 转 Word/PDF/HTML 文档转换器。支持 6 种样式模板（商务蓝、技术灰、简洁白、产品红、学术风、默认），自动生成封面、目录、页眉页脚。当用户需要将 Markdown 转成 Word、PDF 或 HTML，生成带样式的文档，或提到文档导出、格式转换时，使用此技能。
⭐ 0· 51·0 current·0 all-time
by冢猫@glory904649854
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the included code: scripts implement Markdown parsing, style templates, image downloading, table extraction, chart generation and .docx creation. Required binaries/env vars are none, which is proportionate for a local converter. Minor incongruities: package.json is structured like an npm file but the project is Python (it lists "python" in dependencies and points main to SKILL.md) — this is a packaging oddity but not a security problem.
Instruction Scope
SKILL.md instructs the agent to run the included Python scripts via subprocess (expected). The code will download network images referenced in Markdown (requests.get), generate charts (matplotlib if installed) and write files (output docx/.temp_images). These actions are appropriate for the stated purpose, but note that downloading images causes outbound network requests to arbitrary URLs present in user-supplied Markdown (expected functionality but a privacy/network consideration). There are also small code-quality mismatches: convert.py imports analyze_document from ai_analyzer but the shown ai_analyzer defines DocumentAnalyzer class (this may be a naming wrapper elsewhere or a minor bug).
Install Mechanism
There is no install spec; this is an instruction-and-script skill that relies on host Python and pip-installed packages. Dependencies listed in SKILL.md and README (python-docx, requests, markdown, beautifulsoup4, Pillow) are reasonable. No remote binary downloads or extract-from-URL installs are used.
Credentials
The skill requests no environment variables or credentials and does not declare config paths. The only external access is optional network image downloads triggered by Markdown content — appropriate for embedding images but worth noting because it causes outbound HTTP(S) requests to hosts referenced in the Markdown.
Persistence & Privilege
The skill does not request always:true and does not attempt to modify other skills or system-wide configs. It writes output files and a temporary images directory inside the output location — normal and scoped to its purpose.
Assessment
This skill appears to do what it says: convert Markdown to .docx/.pdf/.html and apply templates. Before installing or running it: 1) Review any Markdown files for remote image URLs you don't trust (the skill will download them, making outbound requests). 2) Install dependencies in a controlled environment (virtualenv) and verify you are comfortable running arbitrary Python scripts from an unknown source. 3) If you don't need AI image suggestions or chart generation, inspect ai_analyzer.py to confirm it doesn't call external APIs (the provided snippet shows only local analysis and matplotlib usage). 4) Because package.json looks like a leftover/npm-style file, treat this as a Python project — no hidden installers were found. If you want higher assurance, run the scripts in a sandbox and review the full ai_analyzer and convert code paths for any network POSTs or unexpected subprocess calls.Like a lobster shell, security has layers — review code before you run it.
latestvk9770qn9600q42b9er426v9sp584c0q7
License
MIT-0
Free to use, modify, and redistribute. No attribution required.