ClawHub
Back to skill

Security audit

markdown.new

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it broadly routes user-supplied links through a third-party service without safeguards for private or tokenized URLs.

Install this only if you intend to use markdown.new for public web pages. Avoid using it for internal sites, signed download links, authenticated documents, URLs with tokens or session parameters, or confidential customer/business resources unless the skill is updated to require confirmation and sensitivity checks.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:3
Finding

Disclosure of Sensitive Target URLs to a Third-Party Conversion Service

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 3 and 9–21
Vulnerability Type: Uncontrolled disclosure of user-supplied URLs to a third party
Risk Level: Medium

Vulnerable Code

markdown
description: Use markdown.new URLs like `https://markdown.new/{target_url}` to fetch and convert pages into static Markdown. Trigger this skill whenever the user asks to open/read/extract/summarize content from a web link (such as static resource, docs, README, blog post, changelog); Always try markdown.new first and prefer local terminal access (`curl`) instead of direct browsing when markdown.new can serve the page.
markdown
## Markdown.New Local-First Static Access

Use `markdown.new` as the default path to access URL content as structured Markdown.

### Required Behavior

1. Prefer local access with `curl` (or any suitable alternative tools):
```sh
curl -L --fail --silent --show-error "https://markdown.new/<target_url>"
  1. Always attempt markdown.new first when the target is a readable page:
  • docs and manuals
  • GitHub repository home/README pages
  • blog posts and announcements
  • landing pages and product pages
  • changelog and release-note pages
  1. Do not start with direct page browsing if markdown.new can reasonably handle the page.
  2. When markdown.new succeeds, keep using this route for that task unless the user explicitly asks for another method.
text

### Technical Analysis

The skill requires the agent to prepend `https://markdown.new/` to a user-supplied target URL and send the resulting request to an external service. This transfers the complete target URL across a third-party trust boundary.

A URL may contain confidential information in its path, query string, or user-information component, including signed-download parameters, bearer-like tokens, private document identifiers, email addresses, session data, or internal hostnames. The instructions do not require the 
...[truncated 2230 chars]
Remediation
View remediation

Remediation Suggestions

  1. Use direct retrieval as the default for authenticated, private, tokenized, or otherwise sensitive URLs.
  2. Limit third-party conversion to clearly public HTTP or HTTPS resources.
  3. Before routing a URL through markdown.new, reject or require explicit confirmation for:
    • URLs containing user information or credentials.
    • Sensitive query parameters such as token, key, signature, sig, auth, or session identifiers.
    • Localhost, loopback, private, link-local, multicast, and reserved IP address ranges.
    • Internal hostnames and non-public DNS destinations.
  4. Display a clear consent prompt explaining that the complete URL will be sent to an external service.
  5. Remove or redact sensitive query parameters when they are not required to retrieve the public page.
  6. Define an allowlist of supported public schemes and reject non-HTTP(S) schemes.
  7. Replace “always attempt markdown.new first” with a conditional rule that evaluates URL sensitivity and resource visibility before external disclosure.
  8. Document the external service as a trust dependency, including its privacy, retention, logging, and security assumptions.
  9. If third-party conversion remains necessary, use an approved proxy that enforces URL validation, secret redaction, destination controls, request timeouts, and auditable access policies.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger scope is unusually broad: it says to invoke this skill whenever a user asks to open, read, extract, or summarize content from a web link, and to 'always try markdown.new first.' This can cause unintended routing of many common web-access tasks through an external conversion service, increasing the chance of unnecessary data disclosure and reducing user control over how URLs are handled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs retrieval of arbitrary target URLs by embedding them into requests to https://markdown.new/, which transmits the target link to a third-party service. Without a user-facing warning or consent step, users may unknowingly cause internal, private, tokenized, or otherwise sensitive URLs to be shared externally, creating privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.