Markdown to HTML Converter

Convert Markdown files to formatted HTML. Use when the user asks to convert, export, or save a Markdown file as HTML format. Triggers on phrases like "conver...

Security Scan

The skill is internally consistent with its stated purpose (Markdown→HTML conversion) and requests no extra permissions, but its implementation mismatches the SKILL.md claim about safe escaping and can produce HTML that may allow XSS when given untrusted Markdown.

Purpose & Capability

Name, description, SKILL.md, and included script all align: a zero-dependency Node.js converter for Markdown to HTML. There are no unrelated binaries, environment variables, or config paths requested.

Instruction Scope

Runtime instructions are limited to running the bundled Node script or requiring it as a module (expected). However, SKILL.md asserts "Safe escaping — Code blocks escape '<' and '>' to prevent XSS"; the implementation does escape content inside fenced code blocks via escapeHtml(), but several inline transformations are not escaped (inline code, image alt/text, link text/URLs and general paragraph text). That mismatch means converted output can contain raw HTML or characters that lead to XSS if the input is untrusted. SKILL.md also shows a CMS publish example but does not warn that the output may need sanitization before publishing.

Install Mechanism

No install spec and the skill is instruction-only with a bundled JS file. No network downloads, package installs, or extraction steps are present. The zero-dependency claim matches the code.

Credentials

No environment variables, credentials, or config paths are required or accessed; the code only reads from stdin or files provided as arguments.

Persistence & Privilege

The skill is not always-included (always:false) and does not request elevated persistence or modify other skills/system settings. Autonomous invocation is enabled (default) which is normal and expected.

Assessment

This skill appears to do what it says and does not request credentials or external installs, but its HTML escaping is incomplete. If you will convert untrusted Markdown (e.g., user-submitted content) and publish HTML to a website or CMS, you should: (1) review and fix/augment the converter to properly escape or sanitize inline code, link text, image alt text and other content; (2) or run the produced HTML through a well-maintained HTML sanitizer (e.g., DOMPurify or your CMS's sanitizer) before publishing; (3) consider using a battle-tested Markdown library (marked, markdown-it) if you need robust parsing/security; and (4) test with malicious examples (e.g., <script> tags in inline code or malformed link/image syntax) to verify sanitization. The SKILL.md claim about "safe escaping" is incomplete—treat output as potentially unsafe until sanitized.

Convert Markdown files or strings to well-formatted HTML, suitable for web display or CMS publishing.

Quick Start

node scripts/md2html.js <input.md> [output.html]

Or via stdin:

echo "# Hello World" | node scripts/md2html.js -

Or as a Node.js module:

var converter = require('./scripts/md2html.js');
var html = converter.markdownToHtml(markdownString);

Parameters

Parameter	Required	Description
input.md	Yes	Path to source Markdown file, or - for stdin
output.html	No	Output path (defaults to input name with .html)

Supported Markdown Features

Feature	Markdown Syntax	HTML Output
Headings	# h1 through ###### h6	<h1> through <h6>
Bold	**text**	<strong>text</strong>
Italic	*text*	<em>text</em>
Inline code	`code`	<code>code</code>
Code blocks	```lang ```	<pre><code class="language-lang">
Links	[text](url)	<a href="url" target="_blank">text</a>
Images		<img src="url" alt="alt">
Unordered lists	- item or * item	<ul><li>item</li></ul>
Ordered lists	1. item	<ol><li>item</li></ol>
Blockquotes	> text	<blockquote><p>text</p></blockquote>
Horizontal rule	--- or ***	<hr>
Paragraphs	Blank line separation	<p>text</p>

Design Principles

• Zero dependencies — Pure Node.js, works with v0.12+ (no npm install needed)
• CMS-friendly — Output is clean HTML suitable for direct database insertion
• No wrapper HTML — Outputs content HTML only (no <html>, <head>, <body>)
• Safe escaping — Code blocks escape < and > to prevent XSS

Typical Use Cases

1. AI Content Pipeline — LLM generates Markdown → convert to HTML → publish to CMS
2. Static site generation — Batch convert .md files to .html
3. Documentation — Convert README.md to HTML for web display

Pipeline Integration Example

For automated AI content pipelines that generate Markdown but publish HTML:

var converter = require('./scripts/md2html.js');
var rawMarkdown = llmResponse.choices[0].message.content;
var htmlContent = converter.markdownToHtml(rawMarkdown);
// Now publish htmlContent to your CMS API