← 返回 Skills 市场

FormatFerry Markdown Converter

Name: FormatFerry Markdown Converter
Author: britrik

作者 Britrik · GitHub ↗ · v1.1.3 · MIT-0

cross-platform ✓ 安全检测通过

118

总下载

当前安装

版本数

在 OpenClaw 中安装

/install formatferry-markdown

功能描述

Convert HTML, DOCX, PDF, XLSX, CSV to Markdown

使用说明 (SKILL.md)

formatferry Skill

Convert HTML, DOCX, PDF, XLSX, CSV files to Markdown using the Format Ferry CLI.

Installation

Install the CLI globally:

npm install -g formatferry

Or use npx (requires Node.js):

npx formatferry --help

Authentication

The user has a private API key. Do NOT expose this key in any output or messages.

# Authenticate
scripts/auth.sh --key \x3CAPI_KEY>

# Check status
scripts/auth.sh --status

Scripts

This skill includes secure wrapper scripts with no eval and bash arrays for safe argument handling:

`scripts/convert-to-md.sh` (recommended)

# Convert a local file
scripts/convert-to-md.sh --input /path/to/file.pdf --output output.md --format github

# Convert a URL
scripts/convert-to-md.sh --url https://example.com/article --output article.md

`scripts/convert.sh` (legacy)

scripts/convert.sh --file input.html --output result.md --format github
scripts/convert.sh --url https://example.com --output article.md

Supported formats: github, commonmark, slack, discord, reddit, confluence, custom, rmarkdown

Supported File Types

.html - Web pages
.docx - Word documents
.pdf - PDF files (up to 20MB)
.xlsx - Excel spreadsheets
.csv - CSV files

Security Notes

No eval: All scripts use bash arrays for safe argument passing
No OOM risk: Output streams directly to file + stdout, never captured in shell variables
Recursive path sanitization: Loops repeatedly to strip ....//, ..../, ./, and encoded bypasses (%2e%2e)
Path validation: Blocks writes to /etc, /root, /sys, /proc and sensitive files (passwd, shadow, id_rsa)
Realpath verification: Validates final paths are within allowed WORKDIR before execution
URL validation: Rejects malformed URLs (must start with http:// or https://)

Provenance

Homepage: https://formatferry.vibingfun.com
npm Package: formatferry (official, no public repo)

Notes

API key stored locally after authentication
Premium features may require a license key
Output format defaults to "github" if not specified

安全使用建议

This package appears coherent with its purpose, but before installing: (1) verify the npm package 'formatferry' and the homepage are trustworthy (no public repo is listed here), (2) avoid installing unknown npm packages globally unless you trust them (use npx or a container/sandbox for testing), (3) be aware you must provide an API key and the CLI will store it locally — treat that key like a password, and (4) review the upstream formatferry CLI behavior (network access, telemetry, and where it persists credentials) before using it with sensitive documents.

功能分析

Type: OpenClaw Skill Name: formatferry-markdown Version: 1.1.3 The formatferry-markdown skill is a utility for converting various file formats to Markdown using a CLI tool. The included shell scripts (scripts/auth.sh, scripts/convert-to-md.sh, and scripts/convert.sh) demonstrate a high level of defensive programming, including the use of bash arrays to prevent shell injection, robust recursive path sanitization to block directory traversal, and explicit validation to prevent access to sensitive system files like /etc/passwd or SSH keys. The instructions in SKILL.md include proactive security directives to the AI agent to protect the user's API key. No indicators of malicious intent, data exfiltration, or unauthorized execution were found.

能力评估

✓ Purpose & Capability

Name/description (convert various document types to Markdown) lines up with the included scripts and SKILL.md. The scripts call a 'formatferry' CLI (or npx fallback) and perform conversion; no unexpected services, credentials, or unrelated binaries are requested.

✓ Instruction Scope

SKILL.md and the scripts only describe authenticating to the FormatFerry CLI and converting either local files or URLs. The runtime instructions do not attempt to read arbitrary system files, remote endpoints other than fetched URLs, or aggregate unrelated secrets. They explicitly warn not to expose the API key and limit output to /tmp or current dir.

ℹ Install Mechanism

No registry install spec is embedded (the repo is instruction-only), but SKILL.md recommends 'npm install -g formatferry' or using npx. Installing an unvetted global npm package has known supply-chain and privilege risks; this is expected for a CLI-based tool but you should verify the npm package's trustworthiness before installing globally.

ℹ Credentials

The skill declares no required environment variables and does not request unrelated credentials. It does require the user's FormatFerry API key for authentication (auth.sh invokes 'formatferry auth --api-key ...') and notes the key is stored locally — this is proportional for a paid/locked CLI service but the user should be aware the key will persist on disk via the CLI's storage mechanism.

✓ Persistence & Privilege

The skill is not always-enabled and does not request elevated privileges or modify other skills. Scripts write output to /tmp or a local file, and contain explicit checks to block writes to sensitive system paths. Nothing in the package attempts to escalate presence beyond its own scripts.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install formatferry-markdown
安装完成后，直接呼叫该 Skill 的名称或使用 /formatferry-markdown 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.1.3

Security: recursive path sanitization, block sensitive paths/files, bypassed traversal now blocked

v1.1.2

Fixed provenance - removed non-existent GitHub repo link

v1.1.1

Security fixes: removed eval, bash arrays, streaming output, provenance added

v1.1.0

v1.1.0: Full spec compliance, enhanced discovery triggers, polished tables and security notes for ClawHub/Hermes

元数据

Slug formatferry-markdown

版本 1.1.3

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 4

常见问题