Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
MD to Mobile Image
v2.0.0Convert Markdown files into high-contrast, mobile-friendly PNG images optimized for Telegram and social media sharing.
⭐ 0· 88·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The script implements the described feature (marked → HTML → Playwright screenshot) and writes PNGs to /tmp as expected. However the SKILL.md and code require Playwright at runtime while package.json does not list playwright as a dependency — that mismatch means installation instructions are incomplete and the tool will fail unless Playwright is installed separately. package-lock entries resolve via registry.npmmirror.com (a mirror) rather than the official npm registry, which is unusual and worth verifying.
Instruction Scope
SKILL.md instructs running the CLI against a Markdown file; the implementation reads only the provided file and writes to /tmp. But the code uses marked (which by default allows raw HTML) and then does page.setContent(..., {waitUntil: 'networkidle'}) in Playwright. That will cause the headless browser to load/execute any external resources referenced in the generated HTML (images, fonts, scripts). If the Markdown contains embedded HTML or remote resources, the page can make outbound network requests. This is scope creep relative to a purely offline conversion and could expose your environment's IP to remote hosts or cause other network activity. There is no explicit sanitization of HTML in the code.
Install Mechanism
No install spec is provided. package.json declares only marked and highlight.js, but the runtime requires playright/chromium which is large and platform-specific and typically needs its own install step. The package-lock resolves packages from registry.npmmirror.com (a third-party mirror) — not inherently malicious but atypical; installation behavior is unspecified and may require manual steps (installing Playwright and browsers).
Credentials
The skill requests no environment variables, credentials, or config paths. The filesystem access is limited to reading the user-provided markdown file and writing output PNG(s) to /tmp/md-to-img, which is proportionate to its purpose.
Persistence & Privilege
always: false and no indication the skill persists or modifies other agent/system settings. It creates a local temporary output directory (/tmp/md-to-img) for results, which is normal for a CLI utility.
What to consider before installing
This tool appears to do what it says, but take these precautions before installing or running it:
- Verify and fix the dependency mismatch: Playwright is required at runtime but not listed in package.json. Ask the author to add playwright (and ideally a clear install section) or install Playwright yourself and its browsers before running.
- Prefer installing packages from an official registry. The package-lock references registry.npmmirror.com; confirm you trust that mirror or regenerate a lockfile using the official npm registry.
- Treat input markdown as potentially untrusted: marked allows raw HTML, and the code loads the produced HTML into a real browser which will fetch and execute external resources. If you will convert untrusted markdown, run the tool in a network-isolated sandbox or modify the code to sanitize HTML (disable raw HTML in marked or run a sanitizer) and/or disable network access in Playwright.
- Because Playwright launches Chromium, run the tool on a machine where installing large browser binaries is acceptable and sandboxed.
If you want to proceed, ask the author for an updated package.json including playwright, clear install steps, and a note about network behavior; otherwise run the script in an isolated environment or container to limit exposure.Like a lobster shell, security has layers — review code before you run it.
imagevk97976e4xanhpd1xbjw6qtrpv5839npnlatestvk97976e4xanhpd1xbjw6qtrpv5839npnmarkdownvk97976e4xanhpd1xbjw6qtrpv5839npnmobilevk97976e4xanhpd1xbjw6qtrpv5839npntelegramvk97976e4xanhpd1xbjw6qtrpv5839npn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.