Send Md As

在即时通讯 app 中以优雅图片形式展示 Markdown。支持标题、代码高亮（行号、Monokai）、LaTeX 公式、Mermaid 图表、表格、列表。4 种色彩主题，智能分页。零 CDN 依赖，完全离线渲染。| Render Markdown as a polished image for messagin...

What to consider before installing: - The skill itself appears to do what it says (render Markdown to images/PDF) and its runtime scripts operate on local files only. There is no evidence of data exfiltration in the supplied code. - The claim "Zero CDN dependency / fully offline rendering" is misleading in practice: setup.sh will download Playwright and Chromium and may install npm/pip packages from public registries. Expect network downloads at install time. - setup.sh can call system package managers with sudo and runs npm -g and pip installs (global). These will change your system environment. Prefer running setup in a controlled environment (container, VM, or dedicated dev machine) or adapt the script to use a virtualenv/--user pip installs and avoid global npm installs. - Before running setup.sh: inspect it (you already have it), run with --check-only to see missing deps without making changes, and consider hardening (lock package versions, avoid npm -g, or install dependencies manually). Be aware Playwright will download a Chromium binary (~100s MB). - If you require the "zero CDN/offline" guarantee, ask the author for an offline bundle (pre-bundled Chromium and npm artifacts) or a reproducible install method; otherwise assume runtime/install uses network resources. - Minor note: metadata/version strings are slightly inconsistent (SKILL.md header vs _meta.json and render.sh version), which looks like a bookkeeping oversight but not malicious. - If you do not trust the publisher or cannot run in a sandbox, do not run setup.sh with sudo on a production system.

Type: OpenClaw Skill Name: send-md-as Version: 0.3.2 The skill bundle exhibits risky behaviors including the use of 'sudo' for system-wide installations in 'setup.sh' and the execution of Playwright with the '--no-sandbox' flag in 'render.sh'. It renders HTML generated from Markdown without sanitization, which is a vulnerability that could allow XSS or unauthorized local file access within the headless browser environment. While these capabilities are plausibly needed for the stated purpose of rendering complex Markdown (including LaTeX and Mermaid) to images, the combination of high-privilege setup steps and the lack of input validation represents a significant attack surface.