Markdown Viewer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:48 PM UTC
• Version: 1.2.0

Overview

The skill is a real local Markdown viewer, but it asks users to install a mutable global npm command and run a local server that can read broadly from the user's filesystem by default.

Review this carefully before installing. Prefer a pinned or locally reviewed package version, run it only for trusted workspaces, start it with --root set to the directory you intend to preview, and stop the background server when done.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party Package Is Installed Globally

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-19 and line 31
Vulnerability Type: Unpinned global npm dependency installation
Risk Level: Medium

Vulnerable Code

yaml

"install":
  [
    {
      "id": "npm",
      "kind": "npm",
      "package": "@wipcomputer/markdown-viewer",
      "global": true,
      "bins": ["mdview"],
      "label": "Install markdown-viewer (npm)",
    },
  ],

bash

npm install -g @wipcomputer/markdown-viewer

Technical Analysis

The skill directs the agent or user to install the latest version of a third-party npm package globally. No exact package version, integrity digest, or locally auditable package source is supplied.

Because npm package references without versions normally resolve through a mutable distribution tag such as latest, the code installed at execution time can differ from the code that existed when the skill was reviewed. npm installation may also run package lifecycle scripts under the invoking user's account.

A global installation expands the effect beyond the current project by placing the mdview executable in a global binary location. The package implementation is not included in this repository, so the package's lifecycle behavior and runtime claims cannot be independently verified from the audited artifact.

Attack Path

1. An agent or user follows the installation command in SKILL.md.
2. npm resolves the unversioned package from the configured registry.
3. If the publisher account, registry path, distribution tag, or package release has been compromised, npm downloads the modified release.
4. Package lifecycle scripts, if present, execute with the permissions of the invoking user.
5. The package installs a global mdview executable, which can subsequently execute attacker-controlled behavior whenever invoked.

Impact Assessment

Exploitation could permit arbitrary code execution with the ...[truncated 354 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version rather than using an unversioned package reference.
2. Record and verify the package integrity digest through a lockfile or equivalent trusted verification mechanism.
3. Prefer a project-local installation so that the executable and its effects remain scoped to the project.
4. Review the package contents and lifecycle scripts before installation.
5. Use --ignore-scripts when lifecycle scripts are unnecessary and compatibility has been verified.
6. Consider vendoring the reviewed implementation or including its source in the audited artifact.
7. Run the viewer under a minimally privileged account or sandbox with access limited to the required workspace.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:66

Finding

Markdown Viewer Is Documented to Allow Unrestricted Local File Reads by Default

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 66-68, 86, and 102-103
Vulnerability Type: Excessive local filesystem access through a path-based HTTP endpoint
Risk Level: Medium

Vulnerable Code

markdown

- Server binds to `127.0.0.1` only. It is not accessible from other machines.
- The `/view?path=` parameter reads files from your local filesystem. Use `--root <dir>` to restrict access to a specific directory tree. Recommended for shared environments.
- Zero npm dependencies. No supply chain risk beyond Node.js itself.

markdown

**Page shows the index instead of my file:** The server was started with `--root` restricting access. Restart without `--root`.

markdown

- Do NOT start the server with a file path argument. Always start bare (`mdview`). Starting with a path locks the server to that directory.
- Drag and drop any .md file onto the homepage to view it.

Technical Analysis

The documentation states that the /view?path= endpoint reads paths from the local filesystem and treats --root as optional. It also recommends starting the server without a path restriction and explicitly advises removing --root as a troubleshooting step.

Binding to 127.0.0.1 reduces exposure to remote machines, but it is not a filesystem authorization boundary. Any local client that can reach the endpoint and receive its response may request files accessible to the server process. The server consequently operates with the full readable filesystem scope of the launching user rather than the narrower scope required to render files from one project.

The server implementation is absent from the repository, so path canonicalization, symbolic-link handling, extension enforcement, response access controls, and other mitigations could not be verified.

Attack Path

1. The user follows the quick-start guidance and launches mdview without --root.
2. The server runs with the ...[truncated 835 chars]

Remediation

View remediation

Remediation Suggestions

1. Require --root by default and set it to the active project or the directory containing the selected document.
2. Remove instructions recommending unrestricted startup or restarting without --root.
3. Canonicalize requested paths before authorization and reject paths outside the configured root.
4. Validate symbolic-link targets after canonicalization to prevent traversal outside the allowed tree.
5. Restrict accepted files to necessary Markdown extensions and reject device files, sockets, and other special files.
6. Run the service with a minimally privileged account and limit its filesystem access through sandboxing where available.
7. Add endpoint authorization or an unpredictable per-session access token if clients other than the intended browser could reach the loopback service.
8. Preserve loopback-only binding and fail closed if binding to 127.0.0.1 cannot be established.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file describes how an AI should use the skill, but the phrase "open a .md file in md view" is broad natural language that could overlap with ordinary requests to open or view markdown files. It does not define a clear activation boundary, explicit trigger list, or negative examples to distinguish when this skill should be invoked versus normal file-opening behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.