Notes Export Api

通过可配置的 notes-export-api 导出接口，把 Markdown 内容导出为锤子便签风格的长图 PNG。脚本会优先探测本地生产入口 `http://127.0.0.1:18080`，探测不到时再回退到 `https://notes.fangyuanxiaozhan.com/api/export`；如...

This skill will read local Markdown and image files and upload any local images to a notes-export backend; by default it prefers a local service at http://127.0.0.1:18080 but will fall back to https://notes.fangyuanxiaozhan.com if the local service is absent, or to whatever you set in NOTES_EXPORT_API_BASE_URL in a .env file. Before installing or running: (1) review or run the remote service code if you plan to use the remote host, or run a local instance to avoid sending files off-host; (2) inspect any .env files in your repo/skill directory because the script sources them (they may contain secrets you don't want in the process environment); (3) do not pass sensitive images or private data to the tool unless you trust the target service; (4) if you need offline-only processing, consider modifying the script to disable network uploads or host your own export service.

Type: OpenClaw Skill Name: notes-export-api Version: 0.1.2 The skill exports Markdown to PNG by sending content to a remote API (https://notes.fangyuanxiaozhan.com). A significant security risk exists in `scripts/export_note.sh`, which automatically parses Markdown for local file references and uploads them to the remote server to handle images. Because the script resolves absolute paths and `file://` URIs without sanitization, it could be exploited via prompt injection or malicious Markdown files to exfiltrate sensitive local data (e.g., ``). While this behavior aligns with the stated purpose of rendering images, the lack of path restrictedness makes it high-risk.