MDshare Agent
PassAudited by ClawScan on May 1, 2026.
Overview
MDShare Agent is a coherent instruction-only sharing skill, but users should only publish content they intend to share and should protect manage/edit links.
Install only if you want the agent to publish Markdown through MDShare. Before use, confirm you trust the selected MDShare base URL, avoid sharing confidential content unless intended, and keep manage/edit links private because they can allow changes or deletion.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Content may leave the local conversation and become reachable by link through the selected MDShare service.
Markdown content is sent to an external MDShare deployment, and the selected deployment can change if the caller provides a different base URL.
Default base URL: `https://share.yekyos.com`; If the caller provides another deployment, use that instead. ... Send `POST /api/shares` with JSON: `markdownContent`
Verify the base URL and only publish Markdown that the user intends to share through that deployment.
Anyone who obtains a manage or edit link can perform the permissions associated with that token; the owner token can delete or change settings.
The manage/edit URLs and `x-share-token` header act as bearer permissions for editing, changing settings, or deleting a share.
Manage: `{baseUrl}/e/{slug}#manage={ownerToken}` ... Use header: `x-share-token: <token>`Keep manage/edit links private and return or share them only when the user needs those capabilities.
A mistaken target link, token, or confirmation could update or delete a temporary share.
The documented workflows can modify or delete remote shares, but they include user-control safeguards such as explicit confirmation for force overwrite and delete when intent is not already clear.
When saving new Markdown, send `PATCH /api/shares/{slug}/manage` ... Only use `force: true` after explicit confirmation. ... Call `DELETE /api/shares/{slug}/manage`.Review the target share and requested action before update/delete operations, and preserve the explicit confirmation guardrails.