ClawHub
Back to skill

Security audit

markdown-extract

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it sends a user-provided URL to markdown.new and returns extracted markdown.

Install only if you are comfortable sending target URLs to markdown.new. Avoid using it on private intranet pages, localhost services, cloud metadata endpoints, presigned links, or URLs containing tokens or credentials.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill transmits a user-supplied URL to the third-party service markdown.new, which may disclose sensitive internal, pre-signed, or private-resource URLs to an external provider without explicit notice to the user. In an agent setting, this is more dangerous because users may assume the tool fetches content directly, while it actually shares the target URL with another service, potentially leaking secrets embedded in the URL or metadata about internal resources.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"-d", json.dumps({"url": url, "method": method})
            ]
        
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.