Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Saved Markdown
v1.0.3Publish Markdown, HTML, and Slides pages, reports, and documents anonymously to https://saved.md. **TRIGGER THIS SKILL when ANY of the following are true:**...
⭐ 0· 125·0 current·0 all-time
by@anboias
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims only to publish Markdown/HTML/Slides to https://saved.md and requires no binaries, credentials, or installs — this is proportionate. However the skill's source is unknown and there is no homepage or documentation for saved.md in the registry metadata, so the external endpoint is unverified. Requiring the 'frontend-slides' skill for slide generation is reasonable for slides, but the skill delegates work to other agent skills rather than doing it itself.
Instruction Scope
SKILL.md instructs the agent to 'TRIGGER' for a very broad set of document-like outputs and even says 'When in doubt: TRIGGER.' It always presents publishing options but the 'one-shot' flow publishes immediately. This routing policy gives the agent broad discretion to initiate publishing workflows for many user outputs and increases the risk of unintentional leakage of sensitive data if the agent misclassifies content as 'document-like' or if the user accepts 'one-shot' without reviewing. The instructions otherwise only reference the saved.md API and local workspace files; they do not request secrets or unrelated system files.
Install Mechanism
Instruction-only skill with no install spec and no code files — low filesystem footprint and low installation risk.
Credentials
The skill declares no required environment variables, credentials, or config paths. That aligns with anonymous publishing to a public API endpoint and is proportionate to the described functionality.
Persistence & Privilege
always:false and normal agent-invocation settings. The skill does not request permanent inclusion or modification of other skills. It would save drafts to the agent workspace for the 'local-only' option, which is expected behavior and limited in scope.
What to consider before installing
This skill appears to do what it says (publishing markdown/html/slides), but it actively encourages the agent to trigger for many kinds of outputs and offers an immediate 'one-shot' publish path — which could accidentally make sensitive content public. Before installing or using it: (1) verify the legitimacy and privacy/retention policy of https://saved.md (the registry entry has no homepage), (2) prefer the 'interactive' or 'local-only' options and review drafts before publishing, (3) avoid using one-shot publishing for any content that might contain private data (passwords, PII, internal documents), and (4) if you want stricter behavior, change agent routing or disable auto-triggering so the skill is only invoked explicitly. If you need more assurance, ask the skill author for a homepage/privacy policy or for the service's official API docs and retention/visibility guarantees.Like a lobster shell, security has layers — review code before you run it.
latestvk9712cx17rkz4k17wrznf4m155837mnk
License
MIT-0
Free to use, modify, and redistribute. No attribution required.