Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

html-to-pdf

v1.0.0

Convert an HTML file to a PDF using headless Chrome (Puppeteer) — the same approach atypica uses for its AI-generated research reports. Use this skill whenev...

0· 103·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for owenrao/html2pdf.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "html-to-pdf" (owenrao/html2pdf) from ClawHub.
Skill page: https://clawhub.ai/owenrao/html2pdf
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install html2pdf

ClawHub CLI

Package manager switcher

npx clawhub@latest install html2pdf
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (html-to-pdf via headless Chrome) match the provided files and instructions. The included script implements the stated functionality and there are no unrelated credentials, binaries, or config paths requested.
Instruction Scope
Instructions and the script operate on local HTML files (read, patch, write temp file, produce PDF) as described. The script intentionally fetches external resources (Google Fonts, Tailwind CDN, remote images/CSS referenced by the HTML) when rendering; this means Chromium will perform outgoing network requests to those hosts. The script also launches Chromium with --no-sandbox (documented in SKILL.md), which is commonly necessary in containers but reduces sandboxing. These behaviors are expected for accurate rendering but are worth noting as they cause network traffic and reduce process isolation.
Install Mechanism
This is an instruction-only skill (no registry install). The recommended install is npm install (puppeteer) which will download many npm packages and a pinned Chromium binary (~170 MB). The packages come from the npm registry (package.json/package-lock.json present); there are no downloads from obscure personal servers in the provided files. Installing will write dependencies and a large browser binary to disk.
Credentials
No environment variables, credentials, or external config paths are required or requested. The script only uses local filesystem access to read input and write output (intended behavior).
Persistence & Privilege
The skill does not request persistent or elevated platform privileges, does not set always:true, and does not modify other skills or system-wide agent settings. It writes a short-lived temporary file next to the input HTML and deletes it on exit.
Assessment
This skill appears to do what it says. Before running: (1) Be aware npm install puppeteer will download many packages and a ~170 MB Chromium binary; ensure you have bandwidth/disk space. (2) Rendering may cause Chromium to fetch external assets (Google Fonts, CDNs, remote images referenced in the HTML) — if the HTML contains URLs to private services, those hosts will see requests (possible data leakage). (3) The script runs Chromium with --no-sandbox (often required in CI/Docker); for untrusted HTML run it in an isolated container or VM. (4) Requires Node ≥18; review the HTML you convert if it contains sensitive data or external references.

Like a lobster shell, security has layers — review code before you run it.

latestvk974q8bt9xzdzy3h83npsxt2g583jf92
103downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Overview

This skill converts an HTML file to PDF using Puppeteer (headless Chromium), exactly how atypica exports its AI research reports. Two modes are supported:

ModeWhen to use
Single-page (default)Design/report pages meant to look like one tall poster — no page breaks. Full-width at 1440 px.
PaginatedDocuments meant to be printed or read page-by-page (A4, Letter, etc.).

Quickstart (3 steps)

# 1. Copy the bundled scripts to a working directory
cp <skill-dir>/scripts/html-to-pdf.js ./
cp <skill-dir>/scripts/package.json ./

# 2. Install the only dependency (downloads Chromium automatically, ~170 MB, one-time)
npm install

# 3. Run
node html-to-pdf.js report.html report.pdf

<skill-dir> is the directory that contains this SKILL.md file.

Note: npm install puppeteer (~170 MB) downloads a pinned Chromium binary. This is the only install step — no system Chrome, no wkhtmltopdf, no separate server needed. If the environment already has Puppeteer installed, skip step 2.


Command reference

node html-to-pdf.js <input.html> <output.pdf> [options]

Options:
  --paginated         A4-paginated mode (respects @media print, page-breaks)
  --format <fmt>      Page format: A4 (default), A3, Letter, Legal
  --width <px>        Viewport width for single-page mode (default: 1440)
  --wait <ms>         Extra milliseconds to wait after page load (for JS-rendered content)
  --header-footer     Add page-number footer in paginated mode

Examples

# Single-page full-height (atypica report style)
node html-to-pdf.js report.html report.pdf

# A4 paginated document
node html-to-pdf.js document.html document.pdf --paginated

# A4 with page numbers
node html-to-pdf.js document.html document.pdf --paginated --header-footer

# Narrower single-page layout
node html-to-pdf.js report.html report.pdf --width 1280

# Wait 2 s for JavaScript-rendered charts
node html-to-pdf.js dashboard.html dashboard.pdf --wait 2000

How it works (mirrors atypica's browser service)

  1. Launches headless Chromium via Puppeteer with sandbox disabled and CJK font hints enabled.
  2. Loads the HTML from a file:// URL so relative assets (images, local CSS) resolve correctly.
  3. Injects system-font CSS to ensure Chinese/Japanese/Korean characters render on any OS.
  4. Single-page mode: measures document.body.scrollHeight, sets viewport to that height, and generates a single-page PDF at that exact size — no clipping, no page breaks.
  5. Paginated mode: injects @media print CSS for clean page-breaks, then generates a standard-format paginated PDF.
  6. Writes the PDF buffer to the output path.

Handling common issues

ProblemFix
Chromium not found after npm install puppeteerRun npx puppeteer browsers install chrome
Missing system fonts / boxes instead of CJK charsInject works for most cases; for guaranteed rendering install fonts-noto-cjk (Linux) or ensure macOS system fonts are accessible
JavaScript-rendered content missingAdd --wait 2000 (or more) to let JS execute after load
Images not loadingMake sure image src paths are relative to the HTML file location
PDF cut off at bottomThe script auto-measures height; if content loads lazily add --wait
--no-sandbox error in strict containerPuppeteer requires --no-sandbox in Docker/CI; this flag is already set

Dependency notes

  • Node.js ≥ 18 required (≥ 20 recommended)
  • puppeteer is the only npm dependency — it self-contains Chromium
  • No global Chrome installation needed
  • Works on macOS, Linux, and Windows (WSL)
  • In CI/Docker, add --disable-dev-shm-usage (already included in the script)

Comments

Loading comments...