安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do what it says: it runs a mineru-open-api CLI which uploads documents to MinerU's cloud for conversion. Before installing, consider: (1) privacy — documents (including any sensitive content) will be uploaded to an external service without an account or API key for the 'flash-extract' flow; review MinerU's privacy policy and terms; (2) verify the mineru-open-api package sources (npm package name and the GitHub repo) and confirm you trust them before installing binaries; (3)...详细分析 ▾
✓ 用途与能力
The name/description (convert DOCX/PPTX/XLSX to Markdown) matches the required binary (mineru-open-api) and the instructions. There are no unrelated env vars, binaries, or config paths requested.
ℹ 指令范围
Instructions stay within the stated purpose but explicitly direct the agent to upload documents (local files or URL) to MinerU's cloud API (flash-extract). This is expected for a cloud-based conversion service but is important privacy-relevant behavior to be aware of.
✓ 安装机制
Installers are via common package ecosystems (npm, go) and create a mineru-open-api binary. These are typical install mechanisms; the SKILL.md also points to the vendor homepage for downloads. No direct arbitrary URL downloads or extract-from-unknown-host steps are present in the declared install specs.
✓ 凭证需求
No environment variables, credentials, or config paths are requested. The SKILL.md states no API key is required for flash-extract, and authentication is only mentioned for the higher-privilege 'extract' mode—this matches the declared requirements.
✓ 持久化与权限
The skill is not always-included and does not request elevated persistence or cross-skill/system configuration changes. Autonomous invocation is allowed (platform default) but not combined with other red flags.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/26
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install word2md
镜像加速npx clawhub@latest install word2md --registry https://cn.longxiaskill.com 镜像可用