📦 markdown-converter — 技能工具

v1.0.0

Convert documents and files to Markdown using markitdown. Use when converting PDF, Word (.docx), PowerPoint (.pptx), Excel (.xlsx, .xls), HTML, CSV, JSON, XM...

0· 26·0 当前·0 累计

by @modestyrichards (ModestyRichards)·MIT-0

文件处理文档工具

下载技能包

License

MIT-0

最后更新

2026/4/14

安全扫描

VirusTotal

无害

查看报告

OpenClaw

可疑

high confidence

The skill's instructions and metadata are inconsistent: it references a required SKILLBOSS_API_KEY and a local 'uvx' tool that are not declared in the registry, and it sends documents to an external API — a plausible privacy/exfiltration risk that isn't clearly justified.

评估建议

This skill has several inconsistencies you should resolve before installing or providing secrets. Key things to check: (1) Confirm whether SKILLBOSS_API_KEY is actually required — the registry metadata omits it but SKILL.md declares it. Only provide that API key if you trust the destination (https://api.heybossai.com) and understand the privacy policy. (2) Ask whether 'uvx' is expected to be preinstalled or whether the skill will install it; currently the skill references 'uvx markitdown' but pr...

详细分析 ▾

⚠ 用途与能力

The skill claims to convert files to Markdown locally via 'uvx markitdown', but the registry metadata lists no required binaries while SKILL.md repeatedly uses 'uvx'. SKILL.md also pushes users toward an external SkillBoss API (api.heybossai.com) for 'enhanced' extraction and declares SKILLBOSS_API_KEY as required. Requiring an external API key is not obviously necessary for basic local conversion and is not reflected in the registry metadata — this mismatch is incoherent.

⚠ 指令范围

Runtime instructions direct the agent to run a local command (uvx) and, for complex documents, to call a third-party API and send document URLs (via requests.post). That means user documents or URLs may be transmitted off-host to api.heybossai.com. The SKILL.md does not clearly state what data is sent, whether raw file content is uploaded, or the privacy guarantees — so the instruction scope includes external network transmission of potentially sensitive documents.

ℹ 安装机制

This is an instruction-only skill with no install spec (low installation risk). However, it references a local binary ('uvx') and says 'first run caches dependencies' without providing how uvx gets installed; the absence of any declared required binary or install steps is an inconsistency that will affect runtime behavior.

⚠ 凭证需求

SKILL.md declares requires.env: [SKILLBOSS_API_KEY] and shows code that reads os.environ['SKILLBOSS_API_KEY'], but the registry metadata earlier listed no required env vars. A single API key for a third-party service can be appropriate, but the mismatch between metadata and instructions and the lack of clarity about what data will be sent to that API makes the credential request disproportionate or at least poorly documented.

✓ 持久化与权限

The skill does not request always:true, does not modify skill/system configs in the provided instructions, and is user-invocable. There is no evidence it requests persistent elevated privileges.

安全有层次，运行前请审查代码。

License

MIT-0

可自由使用、修改和再分发，无需署名。

查看条款 ↗

运行时依赖

无特殊依赖

版本

latestv1.0.02026/4/14

Initial release of the Markdown Converter skill: - Convert documents to Markdown using markitdown, supporting PDF, Word, PowerPoint, Excel, HTML, CSV, JSON, XML, images (with EXIF/OCR), audio (with transcription), ZIP archives, YouTube URLs, and EPub formats. - Simple command-line interface for conversion, including options for input/output files, file type hints, MIME type, charset, and plugins. - Instructions for enhanced document processing using the SkillBoss API Hub, including example usage with Python. - Output preserves structure such as headings, tables, and lists; supports authentication via SKILLBOSS_API_KEY. - Complete setup guide provided in documentation.

● 无害

安装命令

点击复制

官方npx clawhub@latest install modesty-markdown-converter

镜像加速npx clawhub@latest install modesty-markdown-converter --registry https://cn.longxiaskill.com

数据来源：ClawHub ↗ · 中文优化：龙虾技能库