Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

auto-md2img

v1.3.1

Convert Markdown content to images automatically with GitHub styling, full Chinese support, smart pagination, emoji support, and syntax highlighting. Support...

0· 335·1 current·1 all-time
byFried_Avocado@fried-avocado
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the included scripts: the repository contains Node.js scripts (md_to_png.js, measure_block_height.js) that use marked + Puppeteer to render Markdown and take screenshots. That capability is coherent with the skill's purpose. However there is an internal inconsistency: the top-level registry metadata said 'no required binaries / no install spec', while _meta.json lists 'requires bins: node, npm' and an npm install step. This mismatch should be resolved (node/npm and npm install are realistically required).
!
Instruction Scope
SKILL.md instructs the agent to write temporary files, save intermediate HTML, and emit detailed debug logs (when --debug is enabled). Debug mode will write intermediate HTML and pagination text files to disk which could expose input content. SKILL.md also asserts security features (path traversal protection, 10 MB input size limit, filename cleaning), but the provided code snippets do not show explicit enforcement of path traversal or size checks (writeLog was truncated and validation functions are not visible). The code does create and write files and runs headless Chromium via Puppeteer — expected for the purpose, but you should verify the actual implementation of path sanitization, input-size enforcement, and where debug artifacts/logs are written.
Install Mechanism
No install spec was present in the top-level registry listing, but _meta.json contains an npm install step and package.json declares puppeteer and marked. Installing will run npm install and Puppeteer will typically download a Chromium build (network fetch, potentially large). This is expected for a Puppeteer-based tool but is higher-risk than 'instruction-only' because it causes runtime downloads and binaries to be written to disk.
Credentials
The skill declares no required environment variables, which is appropriate. However _meta.json indicates the skill expects node and npm on PATH; the registry summary listed none—this discrepancy should be clarified. There are no extraneous credential/environment requests in the code or docs.
Persistence & Privilege
The skill does not request 'always: true' and doesn't attempt to modify other skills. It will create output files, caches, and logs in the filesystem (and auto-create directories). That file-writing behavior is normal for this utility but users should confirm location and retention policy for logs and debug artifacts.
What to consider before installing
This package appears to do what it claims (convert Markdown to images using Puppeteer), but a few things to check before installing/using: - Confirm runtime requirements: ensure Node.js and npm are available. npm install will fetch dependencies and Puppeteer will usually download Chromium — expect a network download and extra disk usage. - Review the full scripts (especially writeLog and any code paths executed in --debug) to confirm path traversal and input-size limits are actually enforced. SKILL.md claims protections (path traversal, max 10MB input) but the visible code does not show those checks. - Avoid enabling --debug in production or on sensitive content: debug mode saves intermediate HTML/pagination files and detailed logs that could expose private input data. - Verify output/log file locations and retention/cleanup behavior so sensitive data is not left on disk unintentionally. - Because the package will run a headless browser, consider running it in a restricted environment (container, limited filesystem) if you have sensitive data. If you want, I can (a) list the exact code locations to inspect for path sanitization and size checks, (b) point out missing or inconsistent checks in the code, or (c) produce a short checklist to safely run this tool in a sandboxed environment.

Like a lobster shell, security has layers — review code before you run it.

latestvk975bysk8cnpq3gyyk84kshwj982yc38
335downloads
0stars
4versions
Updated 5h ago
v1.3.1
MIT-0

🥑 Auto MD2IMG Skill

Automatically converts Markdown content to images for sending in any messaging platform, improving reading experience.


✨ Features

  • 🖼️ Automatically converts Markdown to high-definition images
  • 📄 Supports smart pagination, up to 500 lines per page
  • 📏 New: Height-based pagination mode (line count independent, split by pixel height threshold)
  • 🧱 Splits by content blocks, does not cut off headings, code blocks, tables, etc.
  • 🔢 Automatically adds page number annotations
  • 🀄 Perfect support for Chinese fonts
  • 😊 Supports colored Emoji
  • 🎨 GitHub-style rendering
  • 📸 Auto-detect JPEG/PNG format, supports quality adjustment
  • 🔍 Debug mode, output detailed logs and save pagination content
  • ⚡ Background browser management, improved performance for repeated conversions
  • 🧹 Automatic cache cleaning, privacy protection

📖 Usage

When you need to reply to users with Markdown formatted content:

Basic Usage

  1. Save Markdown content to a temporary file (or pass string directly)
  2. Call scripts/md_to_png.js to generate images
  3. Send images to users using <img> tags
  4. Embed paths using corresponding image tags for different messaging platforms
  5. Fall back to sending plain text Markdown if image generation fails

Script Invocation

# Basic usage
node scripts/md_to_png.js input.md

# Specify output directory
node scripts/md_to_png.js input.md ./output

# Custom lines per page
node scripts/md_to_png.js input.md ./output 300

# Custom JPEG quality (1-100, default 80)
node scripts/md_to_png.js input.md ./output 300 75

# Height-based pagination (custom height threshold in pixels, e.g. 2000px)
node scripts/md_to_png.js input.md ./output --height 2000

# Disable pagination entirely (output single image)
node scripts/md_to_png.js input.md ./output --height 0

# Enable Debug mode (output detailed logs + save pagination content)
node scripts/md_to_png.js input.md ./output --debug

Parameter Description

ParameterTypeRequiredDefaultDescription
inputFilestring-Path to input Markdown file
outputDirstringCurrent directoryOutput image directory
maxLinesPerPagenumber500Maximum lines per page (line-based pagination)
imageQualitynumber80JPEG image quality (1-100)
--height <px>number-Height-based pagination threshold in pixels. ≤0 disables pagination entirely (single output image). Overrides line-based pagination.
--debugflag-Enable Debug mode, output detailed logs and save intermediate pagination content

🔧 Configuration

Font Configuration

  • Default fonts: WenQuanYi Micro Hei, WenQuanYi Zen Hei, Noto CJK SC, Noto Color Emoji
  • Supports system font fallback

Output Configuration

  • Output resolution: 2x (HD)
  • Maximum width: 900px
  • Automatically adapts to content height
  • PNG format output

Pagination Configuration

  • Default maximum lines per page: 500 (line-based pagination)
  • Height-based pagination: Split by pixel threshold (--height parameter), independent of line count
  • Smart splitting by content blocks
  • Does not cut off headings, code blocks, quotes, tables, lists
  • Disable pagination entirely by setting --height 0

Debug Mode

When enabled with --debug flag:

  • Outputs detailed processing logs (content block detection, split points, rendering steps)
  • Saves intermediate HTML render files for debugging
  • Saves raw pagination split content as separate text files
  • Includes timing metrics for performance analysis

📂 Script Paths

scripts/md_to_png.js - Main Markdown to image tool

scripts/md_to_png.js Functions:

  • Reads Markdown files
  • Smart content block splitting
  • HTML rendering
  • Puppeteer screenshot
  • Cache cleaning

🎯 Usage Examples

Example 1: Simple Conversion

import { exec } from 'child_process';
import path from 'path';

const markdownContent = `# Hello World\n\nThis is test content.`;

// Save to temporary file
const tempFile = path.join('/tmp', 'temp.md');
fs.writeFileSync(tempFile, markdownContent);

// Call conversion script
exec(`node scripts/md_to_png.js ${tempFile}`, (error, stdout, stderr) => {
  if (error) {
    console.error('Conversion failed:', error);
    return;
  }
  console.log('Conversion successful:', stdout);
});

Example 2: Usage in Chat Applications

// When needing to reply with Markdown content
async function replyWithMarkdown(content, outputDir) {
  try {
    // Call md2img conversion
    const baseName = `reply_${Date.now()}`;
    const files = await convertMarkdown(content, outputDir, baseName);
    
    // Send images using <img> tags
    for (const file of files) {
      await sendMessage(`<img src="${file.path}">`);
    }
  } catch (error) {
    // Fall back to plain text on failure
    await sendMessage(content);
  }
}

Example 3: Height-based Pagination

# Split by 2000px height, ideal for mobile viewing
node scripts/md_to_png.js long_article.md ./output --height 2000

# No pagination, output single long image
node scripts/md_to_png.js short_note.md ./output --height 0

# JPEG quality adjustment for faster sharing
node scripts/md_to_png.js report.md ./output 500 60 --height 1500

Example 4: Debug Mode

# Debug mode for troubleshooting conversion issues
node scripts/md_to_png.js problem_content.md ./output --debug

🔒 Security Features

  • ✅ Path traversal protection (output directory whitelist)
  • ✅ Filename sanitization (illegal character replacement)
  • ✅ Content size limit (max 10MB)
  • ✅ Line count range validation (10-10000)
  • ✅ Configurable cache cleaning policy

📊 Performance Metrics

MetricValue
First browser startup~260ms
Small document conversion (200 words)~2.3s
Medium document conversion (2KB)~2.6s
Large document conversion (5KB)~3.6s
Repeated conversion performance improvement4.5% (single) / 50-70% (batch)

🎨 Rendering Effects

Supported Markdown elements:

  • ✅ Headings (H1-H6)
  • ✅ Text styles (bold, italic, strikethrough, inline code)
  • ✅ Code blocks (syntax highlighting)
  • ✅ Lists (ordered, unordered)
  • ✅ Tables
  • ✅ Quote blocks
  • ✅ Links
  • ✅ Images
  • ✅ Emoji

🆕 New in v1.3.1

  • 📏 Height-based pagination mode (pixel-based splitting, no line count dependency)
  • 📸 JPEG quality adjustment (1-100, balance between quality and file size)
  • 🔍 Debug mode for troubleshooting conversion issues
  • ⚡ 50%+ performance improvement for repeated conversions
  • 🧹 More aggressive cache cleaning for better privacy
  • 📁 Auto directory creation: Automatically creates output directories if they don't exist (no manual setup needed)
  • 🐛 Fixed ENOENT error when output directory doesn't exist
  • 🐛 Fixed "png screenshots do not support quality" error
  • 🐛 Fixed JPEG quality setting not working issue

🛠️ Tech Stack

  • Node.js >= 14
  • Puppeteer (headless browser)
  • marked (Markdown parsing)
  • GitHub style CSS

📝 Trigger Scenarios

All reply scenarios that require outputting Markdown formatted content:

  • Code snippet sharing
  • Technical document replies
  • Tabular data display
  • List organization
  • Long text formatting
  • Use skill-cn.md when user inputs Chinese

⚠️ Notes

  1. First conversion requires browser startup, slightly slower
  2. Recommend enabling skipCacheClear configuration for batch conversions
  3. Large documents may be split into multiple pages
  4. Image files occupy disk space, remember to clean up

Chinese Instructions (中文说明)

Usage

When you need to reply to users with Markdown formatted content:

  1. First save Markdown content to a temporary file (or pass string directly)
  2. Call scripts/md_to_png.js to generate images
  3. Send images to users using <img> tags
  4. Embed paths using corresponding image tags for different messaging platforms
  5. Fall back to sending plain text Markdown if image generation fails

Script Path

scripts/md_to_png.js - Markdown to image tool

Configuration

  • Default fonts: WenQuanYi Micro Hei, WenQuanYi Zen Hei, Noto CJK SC, Noto Color Emoji
  • Output resolution: 2x, clearer images
  • Maximum width: 900px
  • Automatically adapts to content height
  • Default maximum lines per page: 500 lines

Auto MD2IMG Skill - Make Markdown replies more beautiful! 🎉

Comments

Loading comments...