by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's stated purpose (converting Word files via MinerU) matches its instructions, but there are inconsistencies around credential handling and supported outputs and it asks users to globally install an npm package without declaring how the required token is provided.
评估建议
Before installing or running this skill: 1) Verify the npm package 'mineru-open-api' on the npm registry (source code, maintainers, popularity, and postinstall scripts) because global npm installs can execute code during installation. 2) Ask the skill author or documentation how the MinerU API token is supplied (environment variable name, config file, or interactive login). Do not provide credentials until you understand where they are stored and who can read them. 3) Confirm whether PDF output ...详细分析 ▾
ℹ 用途与能力
The name/description align with the instructions to use the mineru-open-api CLI to convert Word files. However, the SKILL.md references a required token for certain operations but the skill metadata declares no credentials or env vars. The description also mentions 'Word to PDF' but the supported conversions table and commands do not show PDF as an output — that's an unexplained mismatch.
⚠ 指令范围
Instructions tell the agent to run npm install -g mineru-open-api and invoke mineru-open-api commands that operate on user-specified files and write output under the user's home directory. The workflow does not instruct how to supply the 'token' (no environment variable name, no config file path, no auth flow), leaving ambiguity about where credentials come from. Otherwise, the commands are narrowly scoped to file conversion and output directories and do not attempt to access unrelated system state.
ℹ 安装机制
The SKILL.md recommends a global npm install (npm install -g mineru-open-api). That is a common but higher-risk install mechanism than a pure instruction-only skill because npm packages can run arbitrary postinstall scripts and will place binaries on the system. There is no install spec in the registry metadata; installation is advisory rather than automatic. This is expected for a CLI-based skill but worth attention.
⚠ 凭证需求
The instructions explicitly say some operations are 'token required' but the skill declares no required environment variables, no primary credential, and provides no guidance on how the token is supplied or stored. This mismatch is disproportionate: a conversion skill that needs an API token should declare how it obtains that token (env var name, config file, or interactive prompt).
✓ 持久化与权限
The skill is not always-enabled and does not request elevated persistence or modify other skills. It is user-invocable and allows agent invocation (the platform default). There is no indication it tries to change global agent settings or retain permanent presence beyond advising a global npm install.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.2.02026/4/6
Added MinerU API integration via mineru-open-api CLI for multi-format conversion
● 无害
安装命令 点击复制
官方npx clawhub@latest install word-converter
镜像加速npx clawhub@latest install word-converter --registry https://cn.clawhub-mirror.com
技能文档
You are a Word document conversion specialist. Convert Word files to any supported format using mineru-open-api.
Installation
npm install -g mineru-open-api
Conversion Workflow
- Quick Markdown conversion (no token):
mineru-open-api flash-extract document.docx -o ./output/
- Multi-format conversion (token required):
mineru-open-api extract document.docx -f md,html,latex -o ./output/
- Batch conversion:
mineru-open-api extract *.docx -f html -o ./results/
Supported Conversions
| Input | flash-extract | extract |
|---|---|---|
| .docx | Markdown | md, html, latex, docx, json |
| .doc | Not supported | md, html, latex, docx, json |
Key Rules
- Default to
flash-extractfor simple .docx → Markdown (under 10MB/20 pages) - Use
extractfor HTML, LaTeX, DOCX, JSON output or .doc input - Batch mode requires
-ooutput directory - For tables: must use
extract(flash-extract doesn't support tables) - Generate default output dir:
~/MinerU-Skill/_ /
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制