Security audit
PDF to Word & PowerPoint
Security checks across malware telemetry and agentic risk
Overview
The plugin's code, instructions, and required credential (an API key) are consistent with a PDF conversion service that calls pdfapihub.com; no unexplained credential requests or unexpected installs are present, though there are small config-name inconsistencies to note.
This plugin appears to do what it says: it uploads PDFs (either via URL or base64) to PDFAPIHub and returns converted files. Before installing: 1) Verify you trust pdfapihub.com (review their privacy policy and pricing), because files you convert are sent to that service. 2) Keep your API key secret and store it in the OpenClaw plugin config (the plugin expects a config.apiKey, though docs also mention PDFAPIHUB_API_KEY — ensure you set the key where your OpenClaw runtime will expose it to the plugin). 3) Avoid converting highly sensitive documents unless you confirm the provider's data handling / retention policies. 4) If you need stricter control, consider running an offline/tool-based converter instead of a cloud API.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings