Doc2Markdown
v1.0.10Lightweight document utility designed to convert files to Markdown (MD), built specifically for intelligent agents (e.g., OpenClaw, ClaudeCode) to read and p...
⭐ 6· 236·2 current·2 all-time
by@haoyt27
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name, description, SKILL.md, and the included Node script all describe and implement the same behavior: read a local file, POST it to https://lab.hjcloud.com/llmdoc, poll for conversion, download a ZIP or single MD, and write output next to the source. Required binary 'node' is appropriate.
Instruction Scope
Instructions and code explicitly read the provided file, upload it to the remote service, poll for status, download results, and write files into the source file's parent directory. This is within the declared scope, but it does involve uploading user documents off‑host and creating files/directories locally — both are explicit in SKILL.md and should be acceptable only if the user is comfortable with that.
Install Mechanism
No install spec; the skill is a bundled Node script and SKILL.md that runs with the system 'node' binary. Nothing is downloaded from unknown URLs during install; network activity occurs at runtime to the service endpoint.
Credentials
The skill requests no environment variables or credentials. It communicates with a single service endpoint (lab.hjcloud.com) which matches the skill purpose. No unrelated secrets or config paths are requested.
Persistence & Privilege
The skill does not request persistent or elevated platform privileges and is not configured always:true. It reads/writes files only in the same directory as the supplied source file (as documented).
Assessment
This skill appears to do what it says: it uploads files to lab.hjcloud.com for conversion and saves results next to the original file. Before installing or using it, consider: (1) Do not upload sensitive/confidential documents unless you trust the service and have reviewed its privacy/data‑retention policy; the SKILL.md warns about this. (2) Verify the endpoint (lab.hjcloud.com) and the project homepage; test with non‑sensitive files first. (3) Review the rest of the script (particularly ZIP extraction code) for path traversal or overwrite behavior if you need stronger assurance — the provided code writes output to the source directory. (4) If you require offline conversion for sensitive data, prefer a purely local converter instead.Like a lobster shell, security has layers — review code before you run it.
latestvk974ccvw0fmar14vcw6kcx1m4s84ta3q
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📄 Clawdis
Binsnode