md-docx
v1.0.0这是一个用于md文件与docx文件相互转换的技能。支持Markdown转Word文档，以及Word文档转Markdown格式。
⭐ 0· 315·4 current·4 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name and description (md ↔ docx conversion) align with the included converter.py and test.md. The Python script uses python-docx and markdown to implement both directions and creates a local output directory for results. Required capabilities are proportional to the task.
Instruction Scope
SKILL.md instructs the agent to accept uploads, validate paths, and call converter.py — that's consistent. It also lists tools (memory_read/memory_write) that the converter.py code does not appear to need; this is likely a minor mismatch in tooling declarations rather than malicious scope creep. The instructions do not request reading unrelated system files or sending data to external endpoints.
Install Mechanism
There is no install spec (instruction-only with a bundled script), so nothing is downloaded at install time. The Python script requires external packages (python-docx, markdown) but these are standard and documented in the script header; no arbitrary remote download URLs or extract operations are present.
Credentials
SKILL.md documents optional environment variables (OUTPUT_DIR, CONVERSION_MODE, KEEP_IMAGES) but the registry shows no required env vars. The converter.py constructor accepts output_dir and keep_images but does not appear to read environment variables directly; this is a minor inconsistency (declared optional env vs. actual code usage) but not a credential or privacy risk. No secrets or unrelated credentials are requested.
Persistence & Privilege
always is false and the skill does not request elevated/system-wide persistence. It creates local output directories for converted files (expected behavior) and does not modify other skills' configs or global agent settings.
Assessment
This skill appears to do what it says: local Markdown ↔ Word conversions using a bundled Python script. Before installing or running it: (1) run the script in an isolated environment (or inspect it yourself) and ensure python-docx and markdown are installed; (2) be aware it will read input files and write output files (creates converted/ by default); (3) it does not request credentials or perform network calls in the provided code, but if you modify the script or run a version that adds network libraries (requests), re-audit for external uploads; (4) for large or sensitive documents, run conversions on a trusted machine or sandbox to avoid accidental exposure. The minor mismatches to note: SKILL.md lists memory tools and environment variables as configurable, but the script does not strictly depend on them—this is likely harmless but worth confirming in your deployment.Like a lobster shell, security has layers — review code before you run it.
latestvk97ecqb0smf0k0asg0eww8q1n582sv08
License
MIT-0
Free to use, modify, and redistribute. No attribution required.