md2pdf-xelatex

Convert Markdown files to PDF with full LaTeX math formula rendering and CJK (Chinese/Japanese/Korean) support. Use when the user asks to convert markdown to...

This skill appears to do what it says: convert Markdown to PDF with math and CJK support, using a bundled, readable shell script. Before installing or running it: 1) Ensure the host has the required system packages (pandoc, texlive-xetex and related texlive fonts, fontconfig providing fc-list, and poppler-utils/pdfinfo) — SKILL.md lists apt packages but the registry metadata omitted required binaries. 2) Because the registry source/homepage is missing, review the included script (scripts/md2pdf.sh) yourself (it is included) and optionally run it on non-sensitive sample files first. 3) Expect the script to probe local fonts (fc-list) and create temporary files in a temp dir that it deletes on exit. 4) If you need stricter safety, run inside a sandbox or VM with limited network and filesystem access. If these checks are acceptable, the skill is coherent and low risk to use.

Type: OpenClaw Skill Name: md2pdf-xelatex Version: 1.0.0 The skill bundle is designed for a legitimate purpose (Markdown to PDF conversion). However, the `scripts/md2pdf.sh` script is vulnerable to LaTeX injection. User-controlled arguments, specifically `--toc-title`, are directly incorporated into the LaTeX header via `pandoc -V "toc-title=$TOC_TITLE"`. A malicious user could inject arbitrary LaTeX commands, potentially leading to arbitrary file reads or even remote code execution if the underlying XeLaTeX engine has `\write18` enabled. This constitutes a significant vulnerability, classifying the skill as suspicious rather than benign, despite the lack of clear malicious intent within the script itself.