markdown-extract
PassAudited by ClawScan on May 1, 2026.
Overview
This skill is consistent with its stated purpose of converting a user-provided URL to markdown, but users should notice that it sends URLs to an external API and depends on curl despite not declaring that requirement.
This appears safe for ordinary public webpages. Before installing, be aware that submitted URLs are sent to markdown.new and that the local curl command must be available; avoid using it with private or sensitive URLs unless you trust the external service.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
URLs submitted to the skill, and the page content fetched by the service, may be visible to or processed by the external provider.
The implementation sends the user-provided URL and selected extraction method to the external markdown.new service.
"https://markdown.new/", "-H", "Content-Type: application/json", "-d", json.dumps({"url": url, "method": method})Use this only for URLs you are comfortable sending to markdown.new, and avoid private, signed, or sensitive authenticated URLs unless you trust that service.
The skill may fail or behave differently on systems without curl, even though the metadata does not disclose that dependency.
The code depends on the local curl executable, while the registry requirements declare no required binaries.
cmd = ["curl", "-s", f"https://markdown.new/{url}"]Ensure curl is available before use, or the publisher should declare curl as a required binary.