Openclaw Skill
ReviewAudited by ClawScan on May 1, 2026.
Overview
This skill appears to do what it claims: it uploads selected PDFs to Shelv for conversion and downloads Markdown results into a local workspace, with the main consideration that your documents and API key are used with an external service.
This looks like a coherent Shelv integration. Before installing, make sure you are comfortable uploading selected PDFs to shelv.dev, protect the SHELV_API_KEY, review file paths before upload, and use --force only when you intend to replace an existing hydrated shelf.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone using the skill should treat the API key as sensitive because it authorizes Shelv API requests.
The skill requires a Shelv API key and uses it for authenticated account operations. This is expected for the service integration, but it gives the agent delegated access to the user's Shelv account.
**Auth:** `Authorization: Bearer $SHELV_API_KEY` on every request.
Use a dedicated Shelv API key if possible, store it securely, and revoke it if you stop using the skill or suspect exposure.
PDF contents, which may include contracts, research, or other sensitive material, are uploaded to Shelv for processing.
The upload script sends a user-specified local file to the Shelv API. This is central to the advertised PDF conversion workflow, but it is a meaningful data transfer to an external service.
-X POST ... -H "Authorization: Bearer $SHELV_API_KEY" ... -F "file=@$FILE_PATH"
Only upload PDFs you are comfortable processing through Shelv, and confirm the selected file path before asking the agent to upload.
Prompt-like text embedded in a PDF could later appear in Markdown files that the agent reads while exploring the shelf.
Converted document content is persisted as Markdown in the OpenClaw workspace where an agent may later read and use it as context. This is purpose-aligned, but the content originates from PDFs and should be treated as document data rather than trusted instructions.
Download and extract the structured Markdown into `~/.openclaw/workspace/shelves/contract/`
Treat hydrated Markdown as untrusted source material, especially for documents from third parties, and avoid letting document text override your instructions.