安全扫描
OpenClaw
安全
high confidenceFiles and runtime instructions align with a Markdown→DOCX converter; no unrelated credentials, installers, or hidden endpoints were found, but review of dependencies and caution with remote images is recommended.
评估建议
This skill appears to do what it claims, but take these precautions before installing or running it:
- Audit dependencies (package.json / package-lock.json) before npm install to ensure you trust the packages and registry mirror. npm install will fetch code into your environment.
- Run the tool in a sandboxed environment if you will convert Markdown from untrusted sources. The converter will perform HTTP requests for remote image URLs found in the Markdown; this can be used to probe internal ser...详细分析 ▾
✓ 用途与能力
The skill name/description (Markdown to DOCX) matches the included code (scripts/convert.js) and declared dependencies (docx, remark, node-fetch). The code reads a .md file, parses Markdown, handles tables, images, code blocks, and writes a .docx — consistent with the stated purpose.
ℹ 指令范围
SKILL.md instructs running npm install and node scripts/convert.js which matches the code. The converter will fetch remote images (HTTP/HTTPS) and will read local files relative to the input Markdown — expected for image support. Minor caution: fetching arbitrary image URLs means the runtime will make outbound HTTP requests for any remote URLs found in Markdown (possible SSRF/probing risk if untrusted Markdown references internal endpoints).
ℹ 安装机制
There is no registry install spec (instruction-only skill), but it includes source and instructs running npm install which will pull packages from npm. That is normal but means dependencies will be installed at runtime; review/verify dependencies before installing. Minor mismatch: package.json 'main' points to main.js while actual script is scripts/convert.js — harmless but an inconsistency.
✓ 凭证需求
The skill requests no environment variables, no credentials, and no config paths — appropriate for a local file conversion utility.
✓ 持久化与权限
Skill is not marked 'always:true' and does not request elevated or persistent platform privileges. It operates as a user-invoked CLI script and writes only the output .docx file to disk.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/23
● 无害
安装命令 点击复制
官方npx clawhub@latest install joe-markdown-to-docx
镜像加速npx clawhub@latest install joe-markdown-to-docx --registry https://cn.clawhub-mirror.com
技能文档
Convert Markdown documents to professional Word DOCX format with full formatting preservation.
Features
- ✅ Complete Markdown support: Headers, paragraphs, lists, code blocks
- ✅ Tables: Full table support with alignment (left/center/right)
- ✅ Images: Local files, remote URLs, and data URLs
- ✅ Text formatting: Bold, italic, inline code, links
- ✅ Code blocks: Syntax-highlighted with borders and background
- ✅ GFM support: GitHub Flavored Markdown extensions
Installation
After installing this skill, run:
cd ~/.openclaw/workspace/skills/markdown-to-docx
npm install
All dependencies are pure JavaScript and work on Windows, macOS, and Linux.
Usage
Convert a Markdown file to DOCX:
node scripts/convert.js [output.docx]
Examples
# Convert with auto-generated output name
node scripts/convert.js document.md# Specify output filename
node scripts/convert.js document.md report.docx
# Convert from current directory
node scripts/convert.js ./README.md ./README.docx
Supported Markdown Features
Text Formatting
Tables
Header 1 Header 2 Header 3 Left Center Right
- Alignment: :---
(left),:---:(center),---:(right) - Header row with gray background
- Bordered cells with padding
Images
!Alt text
!Remote
- Local images: Relative paths from Markdown file location
- Remote images: HTTP/HTTPS URLs (automatically downloaded)
- Data URLs: Base64-encoded images
- Auto-centered with appropriate sizing
Code Blocks
javascript
function hello() {
console.log("Hello!");
}
- Monospace font (Consolas)
- Light gray background
- Border styling
Output Format
Generated DOCX files include:
- 1-inch margins on all sides
- Professional spacing and alignment
- Consistent styling throughout
- Editable in Microsoft Word, Google Docs, LibreOffice
Error Handling
- Missing images: Shows placeholder text instead of breaking
- Network errors: Graceful fallback with error message
- Invalid Markdown: Skips unsupported elements
Dependencies
Automatically installed via
npm install:
docx: Word document generation
unified, remark-parse, remark-gfm: Markdown parsing
node-fetch`: Remote image downloading
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制