Markdown Browser

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:50 PM UTC
• Version: 1.0.0

Overview

The skill behaves like a web_fetch post-processing wrapper, but its normal npm install path uses plaintext third-party dependency URLs that deserve review before installation.

Review or regenerate the npm lockfile before installing. Prefer an HTTPS trusted registry, exact dependency versions, and npm ci with integrity enforcement; the skill logic itself is narrowly scoped, but the dependency download path should be fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: package-lock.json:13

Finding

Runtime Dependencies Retrieved from a Third-Party Mirror over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: package-lock.json:13-20
Vulnerability Type: Insecure dependency source and transport
Risk Level: Medium

Vulnerable Code

json

"node_modules/@mixmark-io/domino": {
  "version": "2.2.0",
  "resolved": "http://mirrors.tencentyun.com/npm/@mixmark-io/domino/-/domino-2.2.0.tgz",
  "integrity": "sha512-Y28PR25bHXUg88kCV7nivXrP2Nj2RueZ3/l/jdx6J9f8J4nsEGcgX0Qe6lt7Pa+J79+kPiJU3LguR6O/6zrLOw==",
  "license": "BSD-2-Clause"
},
"node_modules/turndown": {
  "version": "7.2.2",
  "resolved": "http://mirrors.tencentyun.com/npm/turndown/-/turndown-7.2.2.tgz",
  "integrity": "sha512-1F7db8BiExOKxjSMU2b7if62D/XOyQyZbPKq/nUwopfgnHlqXHqQ0lvfUTeUIr1lZJzOPFn43dODyMSIfvWRKQ==",
  "license": "MIT",
  "dependencies": {
    "@mixmark-io/domino": "^2.2.0"
  }
}

Technical Analysis

The lockfile directs npm to download both runtime packages from a third-party mirror using unauthenticated, unencrypted HTTP. The documented installation procedure executes npm install --omit=dev, so these URLs participate directly in the normal installation path.

Plaintext HTTP permits an on-path party to observe, block, redirect, or modify dependency responses. The included SHA-512 integrity values materially mitigate package substitution because npm should reject an archive whose contents do not match the lockfile. Consequently, arbitrary package replacement through a simple man-in-the-middle attack is not expected to succeed while integrity verification remains enabled and the lockfile remains trusted. Nevertheless, the configuration unnecessarily relies on an untrusted transport and a nonstandard mirror, exposes dependency-request metadata, and permits denial of service or redirection attempts. Risk increases if the lockfile is modified, integrity checking is bypassed, or installation tooling does not enforce the integrity field.

The manifest also declares turndown with the range `^7 ...[truncated 1928 chars]

Remediation

View remediation

Remediation Suggestions

1. Regenerate package-lock.json using the official npm registry over HTTPS:

   bash

   npm config set registry https://registry.npmjs.org/
   rm -rf node_modules package-lock.json
   npm install --package-lock-only
   

2. Verify that every resolved URL in the regenerated lockfile uses HTTPS and points to an approved registry.
3. Pin the direct dependency exactly in package.json:

   json

   {
     "type": "module",
     "dependencies": {
       "turndown": "7.2.2"
     }
   }
   

4. Use deterministic installation in documentation and deployment:

   bash

   npm ci --omit=dev --ignore-scripts
   

   --ignore-scripts reduces lifecycle-script exposure where package functionality does not require installation scripts.
5. Add CI validation that rejects lockfiles containing http:// dependency URLs or unapproved registries.
6. Retain and verify lockfile integrity hashes, review dependency updates, and periodically run an appropriate dependency vulnerability scanner.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The dependency uses a caret range (^7.2.2), which allows automatic installation of newer non-major versions. This can introduce supply-chain risk because builds are not fully reproducible and a compromised or flawed upstream release could be pulled in without an explicit review. In this skill, the risk is somewhat limited because the package is a common markdown conversion library and no obviously dangerous install scripts or privileged operations are shown, but the dependency control weakness is still real.

Content

Scanner excerpt · package.json (reported line 1)May include surrounding context.

json

{"type":"module","dependencies":{"turndown":"^7.2.2"}}

Static analysis

No suspicious patterns detected.