Pandoc Convert

Convert documents between formats using Pandoc CLI (Markdown, DOCX, PDF, HTML, EPUB, PPTX, ODT, RTF, LaTeX, CSV/TSV, Jupyter, etc.). Use when: (1) converting...

This skill appears to legitimately wrap Pandoc for document conversions. Before installing, note: (1) the skill assumes a local 'pandoc' binary (and optionally LaTeX engines like xelatex/lualatex) but does not declare or install them—ensure Pandoc is present and trusted on your system; (2) Pandoc filters, Lua scripts, and custom readers/writers can execute code or perform I/O—avoid running untrusted filters or documents without sandboxing (use --sandbox when handling untrusted input); (3) examples show fetching content from URLs and using server mode—be aware those features perform network access if used; (4) overall risk is low for normal usage, but follow standard precautions when converting documents from unknown sources.

Type: OpenClaw Skill Name: pandoc-convert Version: 1.0.0 The skill provides a comprehensive wrapper for the Pandoc document conversion utility, which is a powerful tool with a large attack surface. It is classified as suspicious because it explicitly documents and enables high-risk capabilities, such as arbitrary code execution via JSON/Lua filters (--filter, --lua-filter) and network access for fetching remote resources, without implementing safety constraints. The wrapper script scripts/pandoc-convert.sh passes all user-provided arguments directly to the pandoc binary, which constitutes a lack of input sanitization for flags and could allow an attacker to trigger these high-risk features if the agent is manipulated into processing untrusted input or using malicious parameters.