marktodocx-skill

• Verdict: Advisory
• Analyzed: Apr 19, 2026, 2:36 AM
• Findings: 0
• Version: 0.1.3
• Hash: aea65841263cbff2250e8ef3bc36b0df12bc2e4944362b4a3d40bc914ae184f0
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: marktodocx-skill Version: 0.1.3 The skill is a Markdown-to-DOCX converter that utilizes a shared Node.js runtime. The code in skill.mjs is well-structured and focuses on parameter mapping, input resolution, and file writing. While it includes a function (ensureExecutableBit) that uses fs.chmod to set executable permissions on bundled Chromium binaries for Mermaid rendering, this behavior is contextually justified and limited to specific browser-related filenames. No evidence of data exfiltration, malicious prompt injection, or unauthorized network activity was found.