plsreadme

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is coherent for publishing markdown as web links, but users should be aware that it sends selected content to an external service and creates permanent public links.

Install only if you are comfortable using the plsreadme MCP server or remote endpoint. Before invoking it, confirm which file or text will be shared and avoid publishing private, confidential, or sensitive material unless public access is intended.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

A selected local document may be uploaded to plsreadme.com and become accessible through a generated link.

Why it was flagged

The skill can read a user-specified local markdown file and upload it to create a link. This is central to the skill’s purpose, but it is still a sensitive action if the wrong file is selected.

Skill content

`plsreadme_share_file` — Share a local `.md` file by path. Reads from disk, uploads, returns link.

Recommendation

Only use the file-sharing tool on documents the user explicitly wants to publish or preview externally.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing or running the MCP server depends on the external npm package resolving as expected.

Why it was flagged

The setup uses `npx -y` to run an external MCP package. This is a purpose-aligned setup step, but the package code is not included in the provided artifacts and the version is not pinned in the instruction.

Skill content

"command": "npx", "args": ["-y", "plsreadme-mcp"]

Recommendation

Review or pin the MCP package version before adding it to a client, especially in sensitive environments.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Content shared through the remote endpoint leaves the local environment and is processed by plsreadme.com.

Why it was flagged

The skill can be configured to use a remote MCP endpoint, meaning shared text or file contents are handled by an external service. This is disclosed and consistent with the skill’s purpose.

Skill content

"url": "https://plsreadme.com/mcp"

Recommendation

Avoid sending confidential or regulated content unless the user understands and accepts the external service’s handling and public-link behavior.