ClawHub
Back to skill

Security audit

Md Export Tool Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a local Markdown conversion helper whose read/write/exec use fits its documented purpose, with some wording that users should treat as broad but not deceptive.

Install only if you trust the md-exporter package source. Use explicit input and output paths, avoid running extraction on untrusted Markdown without reviewing it, and check before writing into directories containing important files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Confidence
78% confidence
Finding
The activation guidance is broad enough to trigger on generic file-processing or content-extraction requests, which can cause an agent to invoke read/write/exec-backed behavior without sufficiently specific user intent. In this skill, that raises the chance of unexpected file creation or command execution in contexts where a narrower, safer tool should be used.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The keyword-based scope is excessively expansive and ambiguous, allowing many unrelated prompts to match because the list includes fragmented and generic terms. In a skill with write and exec capabilities, this can lead to over-triggering and unintended command execution or file operations beyond the user's precise intent.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill describes conversion behavior but does not clearly warn that commands write or create output files on disk. For an agent operating with write/exec tools, omitting this side-effect disclosure increases the risk of surprising file-system changes, overwrites, or artifact creation without informed user consent.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The code-block extraction feature can materialize multiple files or a ZIP archive from document content, but the documentation does not warn about that expansion effect. In agent-driven workflows, this can unexpectedly create many executable or sensitive-looking artifacts on disk, increasing operational and safety risk if the Markdown source is untrusted.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.