Markdown2Doc
v1.0.3Lightweight document utility designed to convert Markdown (MD) files to PDF format. Preserves document structure, heading hierarchy, embedded images. Require...
⭐ 3· 48·0 current·0 all-time
by@haoyt27
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (Markdown→PDF) match the actual requirements and behavior: the script reads a markdown file, gathers local images, and uploads them to a conversion endpoint at lab.hjcloud.com. Required binary (node) is appropriate and no unrelated credentials or system paths are requested.
Instruction Scope
SKILL.md explicitly instructs reading the markdown file and any locally referenced images and uploading them to the service; the script implements precisely that. It does not attempt to read other files, environment variables, or unrelated system config. The SKILL.md and code clearly declare the data upload behavior, which is a privacy consideration rather than an incoherence.
Install Mechanism
No install spec is present; this is an instruction-only skill with a bundled Node script. That is low-risk from an installation perspective (nothing is downloaded at install time).
Credentials
The skill requests only the 'node' runtime and no environment variables or credentials. The script posts data to an external, declared service endpoint without authentication; this is proportionate to its purpose but implies that all uploaded content will be handled by that remote service.
Persistence & Privilege
The skill is not always-enabled and uses normal agent invocation. It does not request persistent system-wide privileges or modify other skill configurations.
Assessment
This skill will read the provided markdown file and any locally referenced images (only files inside the markdown's directory or subdirectories) and upload them to https://lab.hjcloud.com/llmdoc for conversion. That behavior is declared in SKILL.md and implemented in the script. If your documents may contain sensitive or proprietary data, do not use this skill or verify the service's privacy policy and trustworthiness first. Verify the endpoint (lab.hjcloud.com) and the project source if you need stronger assurances or consider an offline/local conversion tool. The script appears to block path traversal and only uploads files in the markdown directory/subdirectories, but it does not authenticate requests and will transmit content to the remote service over HTTPS.Like a lobster shell, security has layers — review code before you run it.
latestvk975dg92mfxtgpwv7b8a85m3kx84vr3d
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📑 Clawdis
Binsnode