Markdown to PDF Converter (v2.0)

• Verdict: Pass
• Confidence: High
• Analyzed: May 1, 2026, 5:40 AM
• Findings: 2
• Version: 2.0.0

Overview

The skill matches its stated purpose of converting Markdown to PDF, with only expected notes about local tool execution and a first-run emoji asset download.

This appears safe for its stated purpose. Before installing, be aware that the first run downloads and caches Twemoji assets from GitHub, and confirm the required local tools and hardcoded helper path are correct for your environment.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI04: Agentic Supply Chain Vulnerabilities

NoteHigh Confidence

What this means

The first conversion may contact GitHub, download about 150MB of emoji assets, and store them locally for future offline use.

Why it was flagged

On first run the script downloads a third-party Twemoji archive from GitHub into a local cache. This is disclosed and purpose-aligned, but users should notice the external download and lack of checksum verification.

Skill content

TWEMOJI_URL="https://github.com/twitter/twemoji/archive/refs/tags/v${TWEMOJI_VERSION}.tar.gz" ... wget -q --show-progress -O "$CACHE_DIR/twemoji.tar.gz" "$TWEMOJI_URL"

Recommendation

Install only if this first-run download is acceptable; consider verifying the source or clearing ~/.cache/md2pdf if you do not want the cached assets retained.

ASI05: Unexpected Code Execution

NoteHigh Confidence

What this means

The conversion depends on local binaries and may fail or run the wrong helper if the hardcoded path does not match the actual installation location.

Why it was flagged

The skill runs local conversion tools and a Python helper script, which is expected for a Markdown-to-PDF converter. The helper path is hardcoded to an absolute workspace path, so users should ensure it points to the intended installed script.

Skill content

python3 /home/ltx/.openclaw/workspace/skills/md2pdf-converter/scripts/generate_emoji_mapping.py ... pandoc "$INPUT_FILE" ... weasyprint "$HTML_TEMP" "$OUTPUT_FILE"

Recommendation

Before relying on it, verify Pandoc, WeasyPrint, wget, and Python 3 are installed and that the Python helper path resolves to this skill’s included generate_emoji_mapping.py.