ClawHub
Back to skill

Security audit

md-out-of-chat

Security checks across malware telemetry and agentic risk

Overview

This skill locally converts Markdown to shareable HTML and does not upload content by itself, but users should be careful with optional broad local-image embedding and public-link deployment.

Install only if you want a local Markdown-to-HTML converter. Keep the default image mode for untrusted documents, review image references before sharing generated HTML, and request public URLs only when you are comfortable publishing the converted content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
77% confidence
Finding
The skill markets itself as local-only by default, but it also includes a deployment-oriented workflow and references a build helper that stages a dist/ directory for web publishing. This mismatch can mislead users and host agents into exposing converted content more broadly than expected, especially if downstream tooling treats deployment artifacts as publish-ready; additionally, claiming screenshot support without implementing it may cause unsafe fallback behavior in host environments.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
When image embedding is enabled, Markdown image references cause the tool to read local files and inline their raw bytes into the generated HTML as base64. This turns a renderer into a local file content exfiltration primitive: any user who converts untrusted Markdown can unknowingly package sensitive local files into an output artifact that is easy to share onward.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The '--embed-local-images=all' option permits absolute-path reads and inlining of any supported local file extension, bypassing the safer same-directory boundary used by 'auto'. In the context of a Markdown conversion skill, this is an unnecessary expansion of filesystem read scope and can be abused by crafted Markdown to capture local content from arbitrary locations into the output HTML.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.