Markdown Linter

Security checks across static analysis, malware telemetry, and agentic risk

Overview

This appears to be a straightforward Markdown linter, with the main things to notice being local file/glob reading and optional outbound link checks.

This skill looks safe for normal Markdown linting. Before installing, be aware that broad glob patterns can scan many local Markdown files, and the optional external link checker will contact URLs found in those files.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If invoked on broad globs, it may read many local Markdown files; if external link checking is enabled, linked sites may receive requests from the user's environment.

Why it was flagged

The skill can process user-selected file paths/globs and, when explicitly enabled, make network requests to validate links. This is disclosed and purpose-aligned, but users should avoid overly broad paths or link checks on sensitive documents.

Skill content
`--input`: Path to Markdown file(s) (supports glob patterns) ... `--check-external-links`: Enable external URL validation
Recommendation

Use narrow input paths and enable external link checking only for documents whose links you are comfortable testing over the network.

What this means

Users have less external information for verifying the publisher, maintenance history, or upstream code source.

Why it was flagged

The artifact does not provide an upstream source or homepage for independent provenance review. This is not evidence of malicious behavior, but it is a supply-chain transparency limitation.

Skill content
Source: unknown; Homepage: none; No install spec — this is an instruction-only skill.
Recommendation

Install only if you trust the registry entry or publisher, and prefer skills with verifiable source links for higher-assurance environments.