Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
jinx
v1.0.0报告输出自动转PDF。当向用户发送Markdown报告文件时，自动转换为PDF后再发送，确保微信和飞书用户可以直接查看。
⭐ 0· 76·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The stated purpose (auto-convert .md to .pdf for WeChat/Feishu) matches the SKILL.md instructions. However, the skill metadata says no required binaries/env, while the instructions assume a Node/npm environment (npx) and even adjusts PATH to include Homebrew. The need for npx/node should be declared.
Instruction Scope
Instructions stay within the stated task (generate PDF from a specific .md and send it). They do not request secrets or unrelated files. But they explicitly run a shell command that downloads and executes an npm package at runtime (npx -y md-to-pdf@latest) and modify PATH to include $HOME/.homebrew/bin — actions that extend beyond simple file conversion and require careful review/controls.
Install Mechanism
There is no install spec, but the runtime uses npx -y to fetch and run md-to-pdf@latest from the npm registry. That dynamically executes third-party code (un-pinned latest) on the host each time — a supply-chain and arbitrary-code execution vector. The skill does not declare Node/npm as a requirement or pin the package version.
Credentials
The skill requests no credentials or sensitive environment variables. Its runtime needs (fonts for Chinese, Node/npx) are operational rather than secret-oriented.
Persistence & Privilege
The skill is not always-enabled and does not request elevated or persistent system privileges. It does not modify other skills or system-wide settings beyond a temporary PATH prepended in the command.
What to consider before installing
This skill does what it says (convert Markdown to PDF for messaging channels) but it runs npx -y md-to-pdf@latest at runtime — meaning it will download and execute code from the npm registry without a pinned version. Before installing or enabling: 1) confirm the environment has Node/npm/npx and add them to the declared requirements; 2) prefer pinning the npm package to a specific trusted version or vendoring the conversion tool into a vetted install step; 3) require user approval before running the conversion for sensitive documents, or run the conversion in an isolated/containerized environment; 4) review the md-to-pdf package (owner, popularity, recent changes) to assess supply-chain risk. If you cannot accept on-demand execution of unpinned npm packages, do not enable this skill as-is.Like a lobster shell, security has layers — review code before you run it.
latestvk97a195dhy4rknrb1javkfg1jx83f4we
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📄 Clawdis