Markdown to HTML Converter

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:12 AM UTC
• Version: 1.0.1

Overview

The skill does what it says, but its HTML converter can produce unsafe browser/CMS output while the documentation presents it as safe for publishing.

Review before installing if you may convert untrusted Markdown or publish the result. This tool is acceptable for local trusted notes, but do not feed its output directly into a website, CMS, or database-rendered page without a real HTML sanitizer and URL validation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/md2html.js:101

Finding

Unsanitized Markdown Conversion Enables HTML Injection and Cross-Site Scripting

Content

View full analysis

'); // Bold **text** text = text.replace(/\*\*(.+?)\*\*/g, '$1'); // Italic *text* (Node v0.12+ compatible, no lookbehind needed) text = text.replace(/\*([^*\n]+?)\*/g, '$1'); // Inline code `text` text = text.replace(/`(.+?)`/g, '$1'); // Links [text](url) text = text.replace(/\[(.+?)\]\((.+?)\)/g, '$1'); // Line breaks (double space at end of line) text = text.replace(/ $/gm, '
'); return text; } ``` Representative output sinks include: ```javascript result.push('

' + inlineFormat(line.replace(/^#\s*/, '')) + '

'); result.push('

' + inlineFormat(line.replace(/^>\s*/, '')) + '

'); result.push('

' + inlineFormat(line.replace(/^[\-\*]\s*/, '')) + '

'); result.push('

' + inlineFormat(line) + '

'); ``` ### Technical Analysis The converter inserts untrusted Markdown content into generated HTML without first applying HTML escaping. The `inlineFormat()` function also places attacker-controlled image URLs, link URLs, alternative text, and labels directly into HTML attribute or element contexts. The only escaping routine in the project is applied to fenced code-block contents. Ordinary paragraphs, headings, list items, blockquotes, inline code, links, and images remain unsafe. This creates multiple exploitation mechanisms: 1. **Direct HTML injection**: Raw HTML in an ordinary Markdown line is preserved inside the generated paragraph. 2. **Attribute inje ...[truncated 2704 chars]

Remediation

View remediation

`, `"`, and `'` where appropriate. - Ensure inline-code content is escaped rather than merely wrapped in ``. 2. **Apply context-aware attribute encoding** - Never interpolate captured regular-expression groups directly into quoted attributes. - Encode image alternative text, image sources, link destinations, and any future attribute values using an attribute-safe encoder. 3. **Validate link and image URL schemes** - Parse URLs and allow only explicitly required schemes, such as `https:`, `http:`, and optionally `mailto:`. - Reject `javascript:`, unsafe `data:`, `vbscript:`, file URLs, control characters, encoded scheme bypasses, and protocol-relative URLs unless specifically required. - Validation must occur after normalization and decoding. 4. **Sanitize the final HTML** - Use a maintained Markdown implementation with secure configuration. - Pass generated HTML through an allowlist-based HTML sanitizer before publishing it. - Allow only necessary elements and attributes, and remove event-handler attributes and dangerous URL protocols. - If raw HTML is unnecessary, disable raw HTML support entirely. 5. **Harden browser integration** - Apply an appropriately restrictive Content Security Policy as defense in depth. - Do not treat converted output as trusted solely because it was produced by this converter. - Preserve `rel="noopener"` and consider adding `noreferrer` where suitable, but do not treat these attributes as an XSS mitigation. 6. **Add security regression tests** - Test raw elements such as `

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill advertises very broad trigger phrases and applicability, which can cause the agent to invoke this skill for generic content-processing requests outside a narrowly scoped Markdown-to-HTML workflow. Overbroad invocation increases the chance of inappropriate tool selection, accidental file handling, or unintended publication of generated HTML into downstream systems such as CMS pipelines.

Content

No source excerpt is available for this finding.