SmartPage

Auto-fit Markdown to one A4 page. Binary search optimal font size, render with 10 themes, export PDF+PNG+MD.

This skill may do what it promises, but the runtime steps include cloning and running code from an unknown GitHub repo with 'npm install' (which can execute arbitrary scripts). Before installing or running: 1) Ask the publisher for a homepage or a verified release (GitHub release tag, npm package name). 2) Verify the repository and inspect package.json and postinstall scripts. 3) Note the SKILL.md is inconsistent (it uses git but doesn't declare git; 'npm smartpage' is not a standard npm command) — ask the author to clarify the exact CLI invocation. 4) If you must try it, run the repo in an isolated environment (container or VM) and set output-dir to a temporary folder (not your Desktop). 5) Do not run 'npm install' or start the dev server on a sensitive machine until you or someone you trust has audited the code. Absence of automated scan findings here does not mean the code is safe.

Type: OpenClaw Skill Name: smartpage Version: 1.0.0 The skill instructions in SKILL.md direct the agent to clone an external repository (https://github.com/fxjhello/SmartPage.git) and execute 'npm install' and 'npm run dev'. This pattern introduces a significant supply chain risk by executing unverified remote code and starting a local web server at runtime, which are high-risk behaviors despite the stated purpose of document formatting.