Markdown to PDF Converter (v2.0)

Offline Markdown to PDF converter with full Unicode support using Pandoc + WeasyPrint + local emoji cache. Converts Markdown documents to professional PDFs w...

This skill appears to do what it claims (offline Markdown→PDF with Twemoji) and does not request credentials, but review the scripts before running them. Key points to consider: - The main script downloads ~150MB from GitHub and writes to ~/.cache/md2pdf; confirm you are OK with that download and storage location. - There is a hard-coded absolute path in md2pdf-local.sh that calls the Python script at /home/ltx/.openclaw/…; on your machine this will likely fail or point to an unexpected location. Edit the script to call the bundled script via a relative path (e.g., use the script's directory or $PWD) before running. - Inspect the scripts for any unwanted commands (they run wget, tar, mv, rm -rf on the cache dir and invoke pandoc/weasyprint). Run them in a sandbox/container or review the code if you have sensitive files or restrictive policies. - Ensure required tools (pandoc, weasyprint, python3, wget) and fonts are installed; run font installation steps only if you trust them. If you want to proceed, either fix the absolute path in md2pdf-local.sh to a relative path or run the generate_emoji_mapping.py manually from the skill folder so the mapping is created with the expected ~/.cache/md2pdf/emojis content. If you need higher assurance, run the first run inside an isolated environment (container or VM).

Type: OpenClaw Skill Name: md2pdf-converter Version: 2.0.0 The skill is designed to convert Markdown to PDF with emoji support, using Pandoc, WeasyPrint, and local Twemoji assets. It is classified as 'suspicious' due to the `scripts/md2pdf-local.sh` script executing external commands (`pandoc`, `weasyprint`) with user-provided input filenames. While the filenames are quoted, this pattern is a common vulnerability vector for shell injection or arbitrary code execution if the underlying tools have flaws. Additionally, the script uses a hardcoded absolute path (`/home/ltx/.openclaw/workspace/skills/md2pdf-converter/scripts/generate_emoji_mapping.py`) to invoke a Python script, which is a robustness vulnerability. There is no evidence of intentional malicious behavior like data exfiltration, persistence, or prompt injection against the agent.