Office To Md V2

Convert PDF, DOC, DOCX, and PPTX office documents to Markdown, supporting legacy .doc files with text extraction and basic formatting preservation.

This skill appears to do what it says (converting office files to Markdown). Before installing or running it: 1) Review and be comfortable with the PPTX converter's behavior — it writes a Python script to /tmp and may attempt to run `pip3 install python-pptx` automatically. If you prefer control, install python-pptx yourself in a controlled environment instead of letting the skill run pip. 2) Run the skill in an isolated environment (sandbox / container) until you trust it, because it executes shell commands (python3, unzip, pip3, rm -rf) and spawns child processes. 3) Update any hard-coded absolute paths in the examples/tests to avoid accidental access to host-specific paths. 4) Inspect or run `npm install` in a safe workspace to fetch Node dependencies from npmjs.org. If you need higher assurance, request the author/source or run the code review and dependency scans before using it with sensitive files.

Type: OpenClaw Skill Name: office-to-md-v2 Version: 0.1.0 The skill is classified as suspicious due to its extensive use of `child_process.execSync` in `office-to-md/utils/pptConverter.js` to execute external commands like `python3`, `pip3`, `unzip`, and `rm`. While the `filePath` argument passed to these commands appears to be properly quoted, the use of `execSync` for auto-installing dependencies (`pip3 install python-pptx`) and running external scripts introduces a significant attack surface and supply chain risk. There is no clear evidence of intentional malicious behavior, but these high-risk capabilities could be exploited if inputs are not perfectly sanitized or if the execution environment is compromised.