Extract content from PowerPoint (.pptx) presentations to Markdown using MinerU. Pulls slide content including text, structure, and formatting into readable o...
Security Analysis
medium confidenceThe skill's stated purpose (extract .pptx to Markdown) matches the tooling and token requirement in broad strokes, but metadata and instructions are slightly inconsistent about whether a MINERU_TOKEN is required and the install path(s) warrant a quick manual check before trusting the package.
The skill name/description (PPTX -> Markdown via MinerU) aligns with required binary (mineru-open-api) and the described commands. Minor incoherence: SKILL.md documents a no-token 'flash-extract' mode, but the registry metadata lists MINERU_TOKEN as a required env var/primary credential, which implies the token is mandatory even though the tool can operate in tokenless mode for quick extracts.
Runtime instructions are narrowly scoped to running the mineru-open-api CLI (flash-extract, extract, auth) against local files or URLs. They do not instruct reading unrelated system files or other environment variables. It does call an interactive 'mineru-open-api auth' and references exporting MINERU_TOKEN.
Install paths are typical: npm package 'mineru-open-api' and a Go 'go install' from github.com/opendatalab. These are expected for a CLI tool, but npm installs run package scripts during install and Go installs pull code from GitHub — users should verify the npm package and GitHub repo before installing globally.
Only MINERU_TOKEN is declared as the required credential, which matches the 'extract' and 'crawl' functionality. The metadata's blanket requirement of MINERU_TOKEN is inconsistent with the documented no-token 'flash-extract' mode; otherwise the requested credential is proportionate to the skill's purpose.
The skill is not always-installed (always: false), requests no config paths, and does not ask to modify other skills or system settings. Autonomous invocation is allowed (platform default) but not combined with other concerning privileges.
Guidance
This skill appears coherent for extracting .pptx files using the MinerU CLI, but check a few things before installing: 1) Verify the npm package (mineru-open-api) and the GitHub repo (opendatalab/MinerU-Ecosystem) to ensure they're the official project and review install scripts. 2) Understand that MINERU_TOKEN is needed for full 'extract' functionality but 'flash-extract' can run without a token — the registry metadata marking the token as required is inconsistent with the README. 3) Do not paste sensitive tokens into a webpage you don't trust; create a token with minimal scope and rotate/delete it if you stop using the skill. 4) If you must install globally, consider installing in a sandbox or container first to inspect runtime behavior.
Latest Release
v0.4.0
SEO: expand description for better ClawHub vector search discovery
More by @mzlzyca
Published by @mzlzyca on ClawHub
