ClawHub
Back to skill

Security audit

Markdown Anything

Security checks for vulnerabilities and agentic risk

Overview

This skill clearly converts user-chosen files through the Markdown Anything API and includes a disclosed credit-balance helper, with no evidence of persistence, hidden execution, or unrelated data access.

Install only if you are comfortable sending selected files to Markdown Anything for processing and using an MDA_API_TOKEN in this environment. Prefer a limited-scope or revocable token, and be aware that the current scripts pass the bearer token through curl command-line arguments, which may be visible to local process observers while a request is running.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/convert.sh:17
Finding

API Token Exposed Through Curl Command-Line Arguments

Content
View full analysis
/cmdline`. The exact visibility depends on operating-system configuration, user boundaries, container isolation, and process-inspection restrictions. TLS protects the token while it is transmitted over the network, but it does not prevent this local command-line disclosure. ### Attack Path 1. An attacker obtains the ability to inspect processes belonging to the user running the skill, or otherwise has access permitted by the host's process-inspection policy. 2. The victim invokes `scripts/convert.sh` or `scripts/credits.sh`. 3. The attacker continuously monitors process argument vectors while waiting for a `curl` process. 4. The attacker captures the argument containing `Authorization: Bearer `. 5. The attacker extracts and replays the token against the Markdown Anything API. 6. The attacker uses whateve ...[truncated 780 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill description says it converts files to Markdown, but it also provides a credits-checking capability that queries account information using the same API token. This behavior mismatch can mislead reviewers and users about what the skill does with credentials, reducing informed consent and masking unexpected data/account access.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/convert.sh (reported line 36)May include surrounding context.

sh
CURL_ARGS+=(-F "optimize_tokens=true")
fi

RESPONSE=$(curl "${CURL_ARGS[@]}" "https://markdownanything.com/api/v1/convert")

SUCCESS=$(echo "$RESPONSE" | python3 -c "import sys, json; print(json.load(sys.stdin).get('success', False))" 2>/dev/null || echo "False")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill exposes shell-executable scripts but does not declare any explicit tool scope or allowed-tools boundary in the skill manifest. That omission weakens reviewability and least-privilege controls, making it easier for the skill to execute commands in a broader shell context than users or hosts may expect.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.