🖼️ Send Md As — Markdown秒变美图
v0.3.2将 Markdown 即时渲染成高清长图，支持代码高亮、LaTeX、Mermaid 图表、表格与列表，4 种主题智能分页，零 CDN 依赖，一键分享到聊天应用。
1· 150·0 当前·0 累计
by 下载技能包
最后更新
2026/4/5
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
What to consider before installing:
- The skill itself appears to do what it says (render Markdown to images/PDF) and its runtime scripts operate on local files only. There is no evidence of data exfiltration in the supplied code.
- The claim "Zero CDN dependency / fully offline rendering" is misleading in practice: setup.sh will download Playwright and Chromium and may install npm/pip packages from public registries. Expect network downloads at install time.
- setup.sh can call system package m...详细分析 ▾
ℹ 用途与能力
The name/description (render Markdown to images/PDF) align with the provided scripts and implementation. However, the SKILL.md claims "Zero CDN dependency, fully offline rendering," while setup.sh installs Playwright and runs 'python3 -m playwright install chromium' and optionally installs npm packages — actions that download runtime artifacts from remote registries/CDNs. This contradicts the offline/CDN-free claim.
✓ 指令范围
Runtime instructions are focused on rendering markdown and sending the resulting media. The SKILL.md explicitly requires manual invocation only. The scripts operate on the input markdown and local temporary files and do not attempt to read unrelated system files or environment variables.
⚠ 安装机制
There is no packaged install spec; the included setup.sh performs network installs via pip and npm, runs 'python3 -m playwright install chromium' (which downloads Chromium), and may call system package managers with sudo. It uses npm -g and system package installs (possible global changes). These are normal for this functionality but are moderate-risk actions because they download dependencies from public registries and require elevated privileges and global installs.
✓ 凭证需求
The skill requests no environment variables, no credentials, and no config paths. The runtime and scripts do not access secrets or unrelated environment variables.
ℹ 持久化与权限
The skill is not marked always:true and does not attempt to persist within the agent. However, setup.sh performs system-level installs (sudo package manager calls, npm -g) that modify the host environment and require elevated privileges — this is expected for installing runtime dependencies but increases the blast radius and should be acknowledged.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.3.22026/3/29
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install send-md-as
镜像加速npx clawhub@latest install send-md-as --registry https://cn.longxiaskill.com镜像同步中