ClawHub
Back to skill

Security audit

markdown-exporter

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Markdown conversion helper, with ordinary file-writing and package-install risks that users should control.

Install only from the expected publisher/source, prefer a pinned or reviewed md-exporter version when possible, and run conversions in a user-approved working directory. Check output paths before running commands, especially code-block extraction, because it can create multiple files or a ZIP from Markdown content.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Package Installation Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–15 and 52–62
Vulnerability Type: Unpinned external dependencies installed from package registries
Risk Level: Medium

The skill instructs users or agents to install md-exporter without specifying an exact version, integrity hash, lockfile, or immutable source revision.

Vulnerable code snippets:

SKILL.md, lines 12–15:

yaml
install:
   - kind: uv
     package: md-exporter
     bins: [ markdown-exporter ]

SKILL.md, lines 52–62:

markdown
### Installation

```bash
# with pip
pip install md-exporter

# with uv 
uv tool install md-exporter

# on OpenClaw
npx clawhub install markdown-exporter
text

### Technical Analysis

These installation methods dynamically resolve packages from external registries. Because no exact package version, cryptographic hash, lockfile, or immutable source commit is specified, the code installed at a later date can differ from the code originally reviewed.

The artifact contains only `SKILL.md` and does not include the dependency implementation. Consequently, the behavior of the installed CLI cannot be verified from this project. This does not establish that the current package is malicious, but it leaves the installation process exposed to upstream account compromise, malicious future releases, registry compromise, or dependency substitution.

### Attack Path

1. An attacker compromises the publisher account, package registry entry, distribution infrastructure, or a future release of `md-exporter`.
2. The attacker publishes a malicious version under the package name used by the skill.
3. A user or agent follows the documented `pip`, `uv`, or ClawHub installation command.
4. The package manager resolves and installs the attacker-controlled release because the dependency is not pinned to a reviewed artifact.
5. Malicious code executes during package installation or when `markdow
...[truncated 629 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin md-exporter to an exact, reviewed version in both the skill metadata and every installation example.
  2. Require cryptographic integrity verification, such as package hashes in a requirements file used with pip --require-hashes.
  3. Provide a reproducible lockfile that records all transitive dependency versions and integrity information.
  4. Reference an immutable, audited source commit or signed release rather than a mutable package name alone.
  5. Document the expected package registry and reject untrusted indexes or alternate package sources.
  6. Verify release signatures or provenance attestations where supported.
  7. Perform installation and document conversion in an isolated, least-privileged environment with access limited to necessary input and output paths.
  8. Add automated dependency and provenance scanning before updating the pinned version.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs installation via npx clawhub install markdown-exporter without pinning a specific version. That can cause consumers to fetch whatever package version is current at execution time, increasing supply-chain risk if a malicious or compromised release is published later.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The usage notes describe file-path based input and automatic dependency handling, but do not clearly warn that conversion commands write or may overwrite output files on disk. In an agent context, omission of this side effect can lead to unintended modification of user files or writing to sensitive locations if paths are chosen unsafely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The code-block extraction feature can create many files or a ZIP archive derived from untrusted Markdown, but the documentation does not warn about that behavior. In an agent workflow, this can amplify risk by causing unexpected filesystem writes, clutter, or packaging of unreviewed content into distributable archives.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.