md2pdf-xelatex

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Users may need to manually install large system packages and cannot verify an upstream homepage from the registry metadata alone.

Why it was flagged

The registry metadata does not provide provenance or machine-readable dependency requirements, even though the skill documentation and script rely on external Pandoc/TeX tools.

Skill content
Source: unknown; Homepage: none ... Required binaries (all must exist): none ... No install spec — this is an instruction-only skill.
Recommendation

Install Pandoc and TeX packages only from trusted OS repositories, and review the included script if provenance matters to you.

What this means

The skill will run local PDF-generation commands and create or replace the specified PDF output file.

Why it was flagged

The script executes the local Pandoc/XeLaTeX toolchain and writes the requested output PDF. This is central to the stated conversion purpose and is not hidden.

Skill content
PANDOC_ARGS=( ... -o "$OUTPUT" --pdf-engine=xelatex ... ) ... pandoc "${PANDOC_ARGS[@]}"
Recommendation

Use it only on Markdown files you intend to convert, choose the output path carefully, and keep the local PDF toolchain installed from trusted sources.