TextIn xParse Document Parse (Safer Fork)

Parse documents into clean markdown or structured JSON via the xparse-cli. Use this skill when the user provides a PDF, image, Office file, HTML, OFD, or oth...

This skill appears to be a legitimate document-parsing helper that expects the third‑party xparse-cli tool, but there are two things to check before installing: (1) the registry metadata omits the declared dependency and config path (xparse-cli and ~/.xparse-cli/config.yaml), so verify you are comfortable with that mismatch; (2) the SKILL.md includes piped-install commands that fetch and execute a script from https://dllf.intsig.net — avoid running curl|sh or PowerShell iex unless you trust the vendor. Safer steps: manually review the installer script before running it, prefer installing from an official package manager or a signed release (GitHub release or vendor-provided binary), and only provide APP_ID/SECRET_CODE to the CLI if you trust the service. If you want higher assurance, ask the publisher for a canonical installation source or an install package (e.g., GitHub release) and confirm the domain dllf.intsig.net belongs to the vendor.

Type: OpenClaw Skill Name: textin-xparse-parser-safe Version: 0.1.1 The skill bundle contains instructions in SKILL.md that steer the AI agent to prioritize the 'xparse-cli' tool over standard libraries and includes a high-risk installation method using 'curl | bash' (and PowerShell 'iex') for a remote script hosted at dllf.intsig.net. While the documentation includes a directive for the agent to warn the user and offer script inspection, the execution of unverified remote code and the aggressive steering of agent behavior are significant security risks. No evidence of explicit malicious intent or data exfiltration was identified.