Joe's Markdown to DOCX Converter

This skill appears to do what it claims, but take these precautions before installing or running it: - Audit dependencies (package.json / package-lock.json) before npm install to ensure you trust the packages and registry mirror. npm install will fetch code into your environment. - Run the tool in a sandboxed environment if you will convert Markdown from untrusted sources. The converter will perform HTTP requests for remote image URLs found in the Markdown; this can be used to probe internal services (SSRF) or trigger network requests you may not expect. - If using sensitive environments (cloud VMs, CI runners), avoid converting untrusted Markdown or block outbound requests during conversion. - Note the small metadata inconsistency (package.json main references main.js while the converter is scripts/convert.js); this doesn't affect running the script directly but is worth fixing. If you are comfortable auditing dependencies and controlling network access for untrusted inputs, this skill is coherent with its stated purpose.

These patterns were detected by automated regex scanning. They may be normal for skills that integrate with external APIs. Check the VirusTotal and OpenClaw results above for context-aware analysis.