Academic Formula Converter

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a straightforward local Markdown formula converter, with ordinary cautions about installing dependencies and converting only trusted Markdown files.

This skill is reasonable for local academic document conversion. Before installing, make sure you trust the Python packages you install, and when converting Markdown from others, check for unexpected image paths or raw HTML before opening or sharing the generated files.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing dependencies may fetch current package versions from the package index, which can change over time.

Why it was flagged

The skill documents installing external Python packages without pinned versions. This is expected for a Python document converter, but users should install from trusted package sources.

Skill content
pip install python-docx markdown
Recommendation

Install dependencies in a trusted environment and consider pinning known-good versions if using this in repeatable or sensitive workflows.

What this means

If a Markdown file from an untrusted source references a local image path that exists, that image could be embedded into the generated document.

Why it was flagged

Image paths embedded in the Markdown are read directly and added to the docx output. The documented --images directory is accepted as an argument but is not used here to restrict where images can be loaded from.

Skill content
if img_match and os.path.exists(img_match.group(2)):
                doc.add_picture(img_match.group(2), width=Cm(14))
Recommendation

Use trusted Markdown inputs, review image links before conversion, and prefer constraining image loading to an approved directory.

What this means

Opening or sharing HTML generated from untrusted Markdown could preserve active or unwanted HTML content.

Why it was flagged

Markdown content is converted into HTML and inserted into the output page. This is expected for HTML export, but raw HTML or scripts in untrusted Markdown may be carried into the generated file.

Skill content
html = markdown.markdown(md_content, extensions=['tables']) ... <body>{html}</body>
Recommendation

Only convert trusted Markdown to HTML, or add HTML sanitization if this skill will process third-party documents.