安全扫描
OpenClaw
安全
medium confidenceNULL
评估建议
This skill is coherent for converting office files to Markdown, but take these precautions before installing or using it: (1) Understand that conversion uploads files to MinerU's cloud with no account or API key — do not upload sensitive or confidential documents unless you trust MinerU and have read their privacy policy. (2) Installing mineru-open-api via npm or go will run third-party code on your machine — inspect the package/repo (https://mineru.net and the linked GitHub repo) and review rec...详细分析 ▾
✓ 用途与能力
The name/description (convert DOCX/PPTX/XLSX to Markdown) matches the runtime instructions and the declared requirement of the mineru-open-api binary. The install specs (npm/go/uv) produce the mineru-open-api binary that the SKILL.md calls; nothing requested appears unrelated to the stated purpose.
ℹ 指令范围
The SKILL.md instructs using mineru-open-api flash-extract on local files or URLs, which is within scope. Important behavioral detail: flash-extract uploads documents to MinerU's cloud for processing (no API key required). This means user documents will be transmitted to a third party — expected for the skill's functionality, but a privacy/security consideration.
ℹ 安装机制
Installation options use npm and a 'go install' from a GitHub repo (and an unspecified 'uv' package manager). These are traceable sources (npm/GitHub) rather than arbitrary download URLs, but installing a CLI from third-party packages will execute code on the host and carries the usual supply-chain risk. No direct red flags like URL shorteners or personal IPs were used.
ℹ 凭证需求
The skill requests no environment variables or credentials (consistent with SKILL.md). However, the skill's operation uploads documents to a cloud endpoint without authentication — this is proportional for a cloud-conversion tool but materially affects confidentiality of uploaded files and should be considered before use.
✓ 持久化与权限
The skill does not request always:true, does not claim to persist or modify other skills, and is user-invocable with normal autonomous invocation settings. It installs its own CLI binary but does not request system-wide privileged changes in the manifest.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/26
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install xlsx-to-markdown
镜像加速npx clawhub@latest install xlsx-to-markdown --registry https://cn.longxiaskill.com 镜像可用