ClawHub
Back to skill

Security audit

Mdnew

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward URL-to-Markdown helper, but users should avoid sending private or token-bearing URLs to the third-party conversion service.

Install only if you are comfortable with requested URLs and resulting page content being handled by markdown.new and its infrastructure. Use it for public pages, not internal sites, authenticated pages, presigned URLs, API tokens in query strings, or confidential documents.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/mdnew.py:5
Finding

Complete User-Supplied URL Disclosed to a Third-Party Conversion Service

Content
View full analysis

Vulnerability Details

File Location: scripts/mdnew.py:5-14
Vulnerability Type: Sensitive data exposure through unrestricted URL forwarding
Risk Level: Medium

Vulnerable Code

python
def fetch_markdown(url):
    # Construct the markdown.new URL
    md_new_url = f"https://markdown.new/{url}"
    
    # Request headers to match the tool's optimized behavior
    headers = {
        "Accept": "text/markdown, text/html",
        "User-Agent": "OpenClaw-MDNew-Skill/1.0"
    }
    
    try:
        req = urllib.request.Request(md_new_url, headers=headers)

Technical Analysis

The script inserts the complete user-supplied URL into a request sent to the external markdown.new service. Although using that service is consistent with the functionality declared in SKILL.md, the implementation does not validate or sanitize the URL before disclosure.

Consequently, all URL components may be transmitted to the third party, including:

  • Usernames and passwords in the authority component.
  • API keys, session identifiers, and signed-access parameters in the query string.
  • Confidential hostnames, paths, filenames, and resource identifiers.
  • URLs referring to private, loopback, link-local, or cloud metadata destinations.

The script accepts an arbitrary command-line string and does not restrict it to valid public HTTP or HTTPS resources. It also does not warn users that credentials and query parameters will leave the target origin. This exceeds the minimum safe privilege required for public-page conversion because authenticated and confidential URLs are treated identically to public URLs.

This is not covert exfiltration: the documentation expressly states that markdown.new performs the conversion. The security issue is the absence of controls preventing accidental transmission of sensitive URL data.

Attack Path

  1. An attacker, untrusted document, or external instruction supplies a URL containing sensitive data, such as `https://example ...[truncated 1318 chars]
Remediation
View remediation

Remediation Suggestions

  1. Parse input with urllib.parse.urlsplit and permit only explicit http and https schemes.
  2. Reject URLs containing username or password fields.
  3. Detect query strings and require explicit confirmation before sending them to the external service; reject known credential-like parameters by default.
  4. Remove fragments because they are unnecessary for ordinary server-side retrieval and may contain sensitive state.
  5. Resolve destination hostnames and reject loopback, private, link-local, reserved, and cloud metadata address ranges where practical.
  6. Clearly disclose before execution that the complete target URL will be sent to markdown.new.
  7. Prefer direct retrieval and local Markdown conversion for authenticated, signed, internal, or otherwise confidential resources.
  8. Use the service's documented parameter-encoding mechanism rather than unvalidated raw string concatenation.
  9. Add automated tests covering embedded credentials, query tokens, malformed URLs, non-HTTP schemes, localhost, private IP addresses, and metadata endpoints.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises network-backed functionality but does not declare any explicit tool scope, permissions, or allowed-tools boundary. That omission weakens reviewability and enforcement, making it easier for an agent to invoke network-capable code without clear user-visible consent or policy constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill encourages sending arbitrary target URLs to markdown.new and describes browser-rendering and AI-based processing, but it does not warn users that requested URLs and retrieved page content may be transmitted to third-party external services. This creates a meaningful privacy and data-handling risk, especially if an agent is pointed at sensitive, internal, authenticated, or proprietary pages.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script sends the user-supplied target URL to the external service markdown.new by embedding it in a request to https://markdown.new/{url}. This can disclose sensitive internal URLs, query parameters, access tokens embedded in URLs, or investigation targets to a third party without explicit warning, which is especially risky in an agent skill intended for automated use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.