Openclaw Skill

Convert PDFs into structured Markdown filesystems and hydrate them into your workspace for exploration with standard Unix tools

This skill appears coherent and implements the documented workflow. If you plan to install: 1) only provide a SHELV_API_KEY you trust (it grants access to your Shelv account), 2) be aware hydrated files are written under ~/.openclaw/workspace/shelves/<name> (the --force flag will remove an existing directory), and 3) the archive is downloaded from a presigned URL supplied by the service — ensure you trust the shelv.dev service and its API keys before use. If you need higher assurance, review the scripts locally before running them and confirm the API host (https://api.shelv.dev) is the intended endpoint.

Type: OpenClaw Skill Name: shelv Version: 1.0.3 The OpenClaw AgentSkills skill bundle for Shelv is classified as benign. While it performs inherently high-risk operations such as uploading user-provided files, making network calls to an external API (`https://api.shelv.dev`), and downloading/extracting archives into the workspace, it implements robust security measures. Specifically, `scripts/shelv-hydrate.sh` includes critical checks to prevent path traversal and symlink attacks within downloaded tar archives, sanitizes user-provided directory names, and verifies archive integrity using SHA256 checksums. There is no evidence of intentional malicious behavior, data exfiltration beyond the stated purpose, persistence mechanisms, obfuscation, or prompt injection attempts against the agent in any of the provided files.