markdown.new

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

When invoked, the agent may use curl to contact markdown.new for the URL being read or summarized.

Why it was flagged

The skill directs the agent to use a local terminal network command. This is central to the stated purpose and appears read-only, but users should know it can cause outbound requests from their environment.

Skill content
Prefer local access with `curl` (or any suitable alternative tools):
```sh
curl -L --fail --silent --show-error "https://markdown.new/<target_url>"
```
Recommendation

Use it for ordinary public pages; ask the agent to use a different method if you do not want local terminal network access.

What this means

The external conversion service can learn the URL being fetched and may access the page content if it is reachable.

Why it was flagged

The skill routes target URLs through the external markdown.new service. This is disclosed and purpose-aligned, but the artifacts do not add privacy guidance for sensitive, private, signed, or token-bearing URLs.

Skill content
Use `markdown.new` as the default path to access URL content as structured Markdown.
Recommendation

Avoid using this skill with private links, signed URLs, URLs containing tokens, or confidential pages unless you are comfortable sending them to markdown.new.