ClawHub
Back to skill

Security audit

Publish To Mdpage

Security checks for vulnerabilities and agentic risk

Overview

The skill’s publishing purpose is clear, but its broad triggers and unsafe command template create avoidable risk of unintended upload or local code execution.

Review before installing. Use this only for markdown you intend to upload to md.page, confirm publication explicitly, avoid private or sensitive files, and replace the documented Python interpolation pattern with a stdin/file-based JSON encoding workflow.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:42
Finding

Arbitrary Python Code Execution Through Unsafe Markdown Interpolation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill’s trigger phrases are broad enough to match common requests like 'share this' or 'create a page', which increases the chance the agent invokes this skill in situations where the user did not clearly intend third-party publication. Because the skill sends content to an external hosting service, over-triggering can lead to unintended disclosure of sensitive or private markdown.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explains how to publish content but does not prominently warn, in user-facing terms, that markdown will be transmitted to an external third-party service and exposed via a shareable URL. That omission undermines informed consent and makes accidental disclosure of private notes, reports, or internal documents more likely.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This is an explicit external transmission path: the skill posts arbitrary markdown content to md.page over the network. While publishing is the intended function, it is still security-relevant because any sensitive content included in the markdown will leave the local trust boundary and be stored by a third party.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

POST https://md.page/api/publish

bash
curl -X POST https://md.page/api/publish \
  -H "Content-Type: application/json" \
  -d '{"markdown": "# Hello\n\nYour content here"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This second example provides a concrete mechanism for transmitting arbitrary markdown to the external service, including content read from files, making the exfiltration path operationally easy to use. The use of Python for JSON encoding is not itself dangerous, but it streamlines sending potentially sensitive content off-platform if the skill is triggered inappropriately or without adequate user awareness.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

  1. To safely handle special characters (quotes, apostrophes, newlines), use Python to JSON-encode the payload, then pipe it to curl:
bash
curl -s -X POST https://md.page/api/publish \
  -H "Content-Type: application/json" \
  -d "$(python3 -c "
import json

Vague Triggers

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The package description and skill metadata advertise publishing broadly as 'any markdown' and 'shareable web page' without describing consent checks, sensitive-content exclusions, or activation guardrails. In an agentic context, this can cause over-triggering or unsafe publication of private notes, reports, or internal documentation when a user asks to 'share this' or similar, increasing the chance of unintended data exposure.

Content

No source excerpt is available for this finding.