by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do what it says: it runs the mineru-open-api CLI to upload and convert documents to Markdown. Before installing or using it, consider: (1) privacy — flash-extract uploads files to MinerU's cloud (verify mineru.net's privacy/storage policy if documents contain sensitive or confidential data); (2) supply-chain trust — prefer installing the CLI from known, verified package sources and check the npm/go package details and repository to ensure authenticity; (3) URL handling — be...详细分析 ▾
✓ 用途与能力
Name/description match the runtime instructions: the skill invokes the mineru-open-api CLI to convert DOCX/PPTX/XLSX to Markdown. Requiring the mineru-open-api binary and offering npm/uv/go install options is coherent with that purpose.
ℹ 指令范围
SKILL.md only instructs use of the mineru-open-api CLI (flash-extract) against local files or URLs. That stays within the declared purpose, but the CLI uploads documents to MinerU's cloud for processing (stated in the doc) — this is expected for the feature but is an important privacy/attack-surface consideration (remote uploads, URL fetching/SSRF risk).
✓ 安装机制
Install options are npm, uv, and go install from a GitHub repo. These are typical package-install mechanisms; none of the install specs point to an untrusted shortener or arbitrary binary download. The go package references a GitHub repo which is traceable via source control.
✓ 凭证需求
The skill declares no required environment variables or credentials, which matches SKILL.md claims (flash-extract requires no API key). No unrelated credentials or config paths are requested.
✓ 持久化与权限
The skill does not request always:true and has no special persistence or system-wide configuration changes. It is user-invocable and can be called autonomously by the agent (the platform default), which is expected for a conversion helper.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/24
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install excel-to-markdown
镜像加速npx clawhub@latest install excel-to-markdown --registry https://cn.longxiaskill.com