← 返回 Skills 市场
Skill 2
作者
claudiodrusus
· GitHub ↗
· v1.0.0
598
总下载
0
收藏
1
当前安装
1
版本数
在 OpenClaw 中安装
/install skill-2
功能描述
Convert Markdown text to beautifully styled, self-contained HTML with embedded CSS. Perfect for newsletters, documentation, reports, and email templates.
安全使用建议
This skill appears to do what it says and runs locally, but treat output HTML as potentially unsafe if the Markdown is untrusted. Before using with third-party or user-provided Markdown, either: (a) sanitize the input (or sanitize the produced HTML) to strip scripts, javascript: URIs, and dangerous tags/attributes (e.g., using html.escape or a library like bleach), (b) avoid opening generated HTML in a browser for untrusted content, or (c) extend the tool to escape HTML in non-code text and validate/relativize image/link URLs. Also note that images referenced in the Markdown will be loaded by a browser when the HTML is opened, which can leak requester IPs and other metadata. If you need robust CommonMark compliance and XSS protection, prefer a well-maintained Markdown library plus an HTML sanitizer.
功能分析
Type: OpenClaw Skill
Name: skill-2
Version: 1.0.0
The `main.py` script contains a Cross-Site Scripting (XSS) vulnerability. User-provided URLs in Markdown links and images (e.g., `[text](url)` or ``) are directly inserted into the output HTML's `href` and `src` attributes without proper sanitization. This allows an attacker to inject `javascript:` URLs, leading to arbitrary JavaScript execution when the generated HTML is viewed, making the skill's output potentially malicious.
能力评估
Purpose & Capability
Name/description match the provided files: a small, zero-dependency Python tool that converts Markdown to styled HTML with embedded CSS. The code implements the claimed features (headings, lists, links, images, code blocks, etc.), though 'Full Markdown support' is an optimistic claim (the converter is a hand-rolled subset, not a complete CommonMark implementation).
Instruction Scope
SKILL.md and main.py are scoped to reading a file or stdin and producing an HTML file (expected). However, the converter does not HTML-escape arbitrary non-code text nor sanitize links/images. That means user-supplied Markdown can inject raw HTML or create links with javascript: URIs, and produced HTML can cause remote resource loads (images) or XSS when opened in a browser. The README does not warn about these risks and 'self-contained' might be misread as 'no external resource loads' (only the CSS is embedded).
Install Mechanism
No install spec; instruction-only with a single local Python script that uses the standard library. Nothing is downloaded or written beyond outputs the script itself creates (the HTML output file). Low install risk.
Credentials
No environment variables, credentials, or config paths are requested — proportional and appropriate for a local file conversion utility.
Persistence & Privilege
No persistent or elevated privileges requested. always is false; the skill does not modify other skills or system configuration.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install skill-2 - 安装完成后，直接呼叫该 Skill 的名称或使用
/skill-2触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release of "markdown-to-html" tool.
- Convert Markdown files to self-contained, styled HTML with embedded CSS.
- Supports full Markdown syntax: headings, formatting, links, images, code, lists, tables, and more.
- Includes two built-in themes: light (GitHub-inspired) and dark mode.
- Produces responsive designs suitable for desktop and mobile.
- Works with files or piped input (stdin); no external Python dependencies.
- Flexible command-line options for theme, title, and output file.
元数据
常见问题
Skill 2 是什么？
Convert Markdown text to beautifully styled, self-contained HTML with embedded CSS. Perfect for newsletters, documentation, reports, and email templates. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 598 次。
如何安装 Skill 2？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install skill-2」即可一键安装，无需额外配置。
Skill 2 是免费的吗？
是的，Skill 2 完全免费（开源免费），可自由下载、安装和使用。
Skill 2 支持哪些平台？
Skill 2 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Skill 2？
由 claudiodrusus（@claudiodrusus）开发并维护，当前版本 v1.0.0。
推荐 Skills