Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Markdown2Doc

v1.0.4

Lightweight document utility designed to convert Markdown (MD) files to PDF or DOCX format. Supports multiple template themes. Preserves document structure,...

3· 110·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for haoyt27/markdown2doc.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Markdown2Doc" (haoyt27/markdown2doc) from ClawHub.
Skill page: https://clawhub.ai/haoyt27/markdown2doc
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: node
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install markdown2doc

ClawHub CLI

Package manager switcher

npx clawhub@latest install markdown2doc
Security Scan
Capability signals
CryptoRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description match the included script and SKILL.md. The only declared runtime dependency is node, which is correct for the provided JavaScript implementation. The script's behavior (converting markdown by calling a remote conversion service) matches the stated purpose.
Instruction Scope
SKILL.md and the script explicitly instruct reading the markdown file and any locally referenced images (from the same directory or subdirectories) and uploading them to the documented endpoint (lab.hjcloud.com). There are no instructions or code paths that read unrelated system files, environment variables, or other credentials; data transmission is declared in the Data & Privacy section.
Install Mechanism
This is an instruction-only skill with an included Node script; there is no install spec that downloads or extracts external artifacts. No risky install URLs or package managers are used.
Credentials
The skill requests no environment variables or credentials. It does perform network uploads to a single hard-coded service (lab.hjcloud.com), and that behavior is disclosed in SKILL.md. The absence of extra secrets or config paths is proportionate to the stated functionality.
Persistence & Privilege
The skill is not marked always:true, is user-invocable, and does not attempt to modify other skills or system-wide settings. It runs only when invoked and does not request elevated or persistent privileges.
Assessment
This skill will read the specified markdown file and any local images (in the same directory or subdirectories) and upload them to https://lab.hjcloud.com/llmdoc for conversion. That network transfer is clearly documented in SKILL.md—do not use this skill on sensitive, confidential, or proprietary documents or images. If you need offline conversion, consider local tools instead. If you plan to use this in a sensitive environment, verify the service's privacy policy and the trustworthiness of the lab.hjcloud.com domain and the linked GitHub repository before proceeding. Finally, because the skill is implemented as a script included in the package, you can review or run the script locally to confirm behavior prior to giving it files to process.
!
scripts/markdown2doc.js:246
File read combined with network send (possible exfiltration).
About static analysis
These patterns were detected by automated regex scanning. They may be normal for skills that integrate with external APIs. Check the VirusTotal and OpenClaw results above for context-aware analysis.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📑 Clawdis
Binsnode
latestvk977er2c910bh9hefjyjxxwht585b142
110downloads
3stars
5versions
Updated 6d ago
v1.0.4
MIT-0

markdown2doc

Document conversion assistant that automatically converts Markdown (MD) files to PDF or DOCX format, saving output to the same directory as the source file.

Quick Start

# Convert markdown to PDF
node scripts/markdown2doc.js convert <file_path> pdf        # Output: same_name.pdf
# Convert markdown to WORD
node scripts/markdown2doc.js convert <file_path> docx       # Output: same_name.docx
# List available themes
node scripts/markdown2doc.js list-themes
# Convert markdown to WORD with a theme
node scripts/markdown2doc.js convert <file_path> docx --theme tech

Capabilities

  • Supported output formats: PDF, DOCX
  • Multiple template themes available (use list-themes to see all options)
  • Preserves markdown structure, headings, lists, tables, and code blocks
  • Generates a navigable table of contents with heading hierarchy
  • Embeds images referenced in the markdown into the output document, including both local images
  • No API Key or account required, minimal external dependencies
  • Output file is saved to the same directory as the source markdown file

Note on local images: To ensure local images are correctly embedded in the output document, image files must be located in the same directory as the markdown file, or in a subdirectory of it (e.g., ./images/photo.png). Images referenced via absolute paths or paths pointing outside the markdown file's directory will be skipped for security reasons.

When to Use

  • User requests to "export", "convert", "generate PDF", "generate DOCX", "generate doc", "generate Word document" from markdown
  • User provides a markdown file path and asks to convert it to PDF, DOCX, or doc
  • User needs a printable or shareable version of a markdown document
  • User asks to apply a specific style or theme when converting to DOCX
  • User asks to list available template themes or wants to know what template themes are supported

Workflow

convert — Convert Markdown File

  1. Read markdown file content from specified path
  2. Scan markdown for local image references and collect image files
  3. Send markdown content to conversion service
  4. Receive converted file stream (PDF or DOCX)
  5. Save output file to source file's parent directory

Data & Privacy

  • convert sends both the markdown file content and all locally referenced image files to the docchain cloud service (lab.hjcloud.com) for processing.
  • Any local image path referenced in the markdown (e.g., ![](./images/photo.png)) will be read from disk and uploaded along with the markdown content.
  • All transfers use HTTPS encryption.
  • Users are responsible for ensuring that neither the markdown content nor any referenced image files contain sensitive, confidential, or proprietary information. Use of this skill constitutes acceptance of the data transmission described above.
  • Service endpoint: https://lab.hjcloud.com/llmdoc

Feedback & Support

For conversion errors, format issues, or other problems, please submit an issue on GitHub: https://github.com/wct-lab/docchain-skills

Comments

Loading comments...