PDF助手

提供PDF转换、合并、拆分、压缩和编辑等功能，支持多种文档和图片格式互转处理。

Before installing, consider these points: - The skill will (per its text) upload user files to an external service (TinyWow). If those files contain sensitive data, you should not send them to a third-party service without certainty about retention and privacy practices. The README claims 24-hour deletion but provides no guarantee or audit details. - The SKILL.md embeds a raw API key for 'SkillPay.me' and pricing info. The skill metadata declares no required credentials, so this is inconsistent. Embedded keys in documentation can be leaked credentials, placeholders, or an attempt to hard-code payment access — ask the author to explain why this key is present, remove it from public docs, and provide a way to set any required keys via environment variables instead. - The instructions are vague about exact API endpoints and how payment is handled. Ask for: (a) concrete API call examples showing where files are sent, (b) a privacy/data-retention statement from the processing provider, and (c) clarification about the payment flow (who is charged and how the embedded key is used). - If you plan to process sensitive documents, prefer a skill that documents explicit endpoints, requires credentials via secure environment variables (not embedded in SKILL.md), or runs locally without sending files to a third party. What would change this assessment: if the author confirms the SkillPay key is a harmless placeholder (and removes it), provides exact API call details and a privacy/retention policy from TinyWow, or updates the skill to require a user-provided payment credential (declared in metadata) instead of embedding a key. Without that, treat this skill cautiously and avoid uploading sensitive files.

Type: OpenClaw Skill Name: pdf-helper Version: 1.0.0 The skill bundle lacks any executable code and consists only of metadata and instructions in SKILL.md. It is classified as suspicious because it instructs the AI agent to charge users 0.001 USDT per call via 'SkillPay.me' for a service it claims is powered by TinyWow (a free online tool), which suggests a potential financial scam or unauthorized monetization. Additionally, the file contains a hardcoded API key, which is a significant security risk.