ClawHub
Back to skill

Security audit

File to Markdown Converter

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it advertises, but it directs agents to send local and private files to an external conversion service without clear per-file consent or sensitivity safeguards.

Use this skill only for files and URLs you are authorized to send to markdown.new. Avoid confidential documents, regulated data, credentials, internal-only URLs, private keys, or business-sensitive files unless you have explicit approval and understand the service's retention and processing terms.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:148
Finding

Unrestricted Disclosure of Private Local Files to an External Conversion Service

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This example embeds a target file URL directly into a request to markdown.new, causing the external service to fetch and process that resource. That behavior can expose sensitive URLs, trigger third-party access to private resources if not restricted, and leak contents beyond the user's expected trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

Example:

bash
curl -s "https://markdown.new/https://example.com/report.pdf"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly instructs agents to upload local files or submit URLs to a third-party service, but it does not warn users that potentially sensitive files, document contents, or internal URLs will be transmitted off-platform for processing. This can lead to unintended disclosure of confidential data and privacy/compliance issues, especially in agent workflows that may automatically process user-provided files.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The JavaScript example performs a POST to an external service with a remote file URL, demonstrating off-platform transmission of potentially sensitive input. In an agent setting, this becomes more dangerous because automation may process arbitrary user content at scale, increasing the chance of accidental data leakage or SSRF-by-proxy against the third-party converter.

Content

Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.

JavaScript (Node.js)

js
const res = await fetch("https://markdown.new/", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This duplicate finding points to the same Python snippet that posts a URL to an external service. Although expected for the feature, it is still security-relevant because agents may forward sensitive document locations or internal endpoints to a third party without adequate notice or filtering.

Content

Scanner excerpt · SKILL.md (reported line 290)May include surrounding context.

python
import requests

res = requests.post(
    "https://markdown.new/",
    json={"url": "https://example.com/file.pdf"}
)

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This duplicate finding points to the same Python snippet that posts a URL to an external service. Although expected for the feature, it is still security-relevant because agents may forward sensitive document locations or internal endpoints to a third party without adequate notice or filtering.

Content

Scanner excerpt · SKILL.md (reported line 290)May include surrounding context.

python
import requests

res = requests.post(
    "https://markdown.new/",
    json={"url": "https://example.com/file.pdf"}
)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly supports converting remote URLs and uploading local files to https://markdown.new, but the description does not clearly warn users that their files, URLs, and potentially sensitive document contents are transmitted to a third-party external service. This can lead to unintentional data exfiltration, privacy violations, or policy noncompliance when users process confidential or internal material under the assumption that conversion is local.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This plain-text skill description explains capabilities and endpoints, but it does not define specific activation phrases, boundaries, or exclusion conditions for when the skill should be invoked. In a skill catalog context, that lack of specificity can lead to unintended activation for generic file-conversion or document-processing requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.