Claw Markdown Preview

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:12 AM UTC
• Version: 1.4.15

Overview

This Markdown preview/editor is not plainly malicious, but it needs review because its local server can modify files through unauthenticated APIs and rendered Markdown can run active HTML.

Install only if you trust the Markdown files you open and accept that edits autosave over the original file. Treat this as a local editor with file-write authority, not a read-only previewer; avoid opening untrusted Markdown until the server has authentication/origin checks and HTML sanitization.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: assets/lib/converter.js:8

Finding

Active HTML Injection in Markdown Preview

Content

View full analysis

' + html + ''; ``` ### Technical Analysis The Markdown parser explicitly enables raw HTML with `html: true`. The resulting HTML is subsequently assigned to `innerHTML` without an HTML sanitizer or restrictive Content Security Policy. Although script elements inserted through `innerHTML` are not consistently executed by browsers, active HTML constructs such as event-handler attributes can execute JavaScript. For example, attacker-controlled Markdown can contain an image with an invalid source and an `onerror` handler. Since the preview is served from the same origin as the local API, injected code can issue fully privileged same-origin requests. This behavior is not required for basic Markdown preview functionality. Raw HTML should either be disabled or sanitized. ### Attack Path 1. An attacker supplies or modifies a Markdown file. 2. The victim opens the file using the preview Skill. 3. `markdown-it` preserves attacker-controlled raw HTML because `html: true` is enabled. 4. The page inserts that HTML into the DOM using `innerHTML`. 5. An activ ...[truncated 991 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/preview_server.py:153

Finding

Unauthenticated State-Changing Localhost APIs

Content

View full analysis

Remediation

View remediation

` and, if intentionally supported, `localhost:`. 6. Require exact expected content types: - `application/json` for JSON APIs; - an allowlisted image type for image uploads. 7. Remove the state-changing GET `/api/close`; permit shutdown only through an authenticated POST. 8. Use `SameSite=Strict` cookies only as defense in depth, not as the sole protection. 9. Consider using an unpredictable available port in addition to authentication. 10. Return explicit errors for unauthenticated, cross-origin, malformed, or oversized requests. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/preview_server.py:288

Finding

Server-Side Image Upload Has No Size Limit

Content

View full analysis

MAX_IMAGE_SIZE) { showToast('图片过大（' + Math.round(blob.size / 1024 / 1024 * 10) / 10 + 'MB），请压缩后粘贴（上限 5MB）'); return; } ``` ### Technical Analysis Security limits enforced only in browser JavaScript can be bypassed by sending requests directly. The server converts the supplied `Content-Length` to an integer, reads that many bytes into one in-memory object, and then writes the complete body to disk. There is no server-side 5 MB limit, streaming limit, request timeout, image signature validation, or cleanup mechanism. The extension is selected from the declared content type rather than verified file content. ### Attack Path 1. The preview server is running with a Markdown file selected. 2. An attacker cap ...[truncated 817 chars]

Remediation

View remediation

MAX_IMAGE_SIZE: self.send_error(413, "Image too large") return ``` 2. Stream the body in bounded chunks rather than buffering it entirely in memory. 3. Stop reading immediately when the cumulative byte count exceeds the limit. 4. Write to a temporary file and atomically rename it only after complete validation. 5. Delete partial files when an error, timeout, or disconnect occurs. 6. Validate file signatures rather than trusting only the `Content-Type` header. 7. Apply request read timeouts and rate limits. 8. Require the per-process authentication token recommended for all API endpoints. 9. Consider rejecting SVG uploads or sanitize SVG content because SVG can contain active or externally referenced content. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/preview_server.py:256

Finding

Filesystem Containment Check Can Be Bypassed by Prefix-Matching Paths

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (60)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This skill advertised as a previewer also writes edited Markdown back to the original file, writes pasted images to disk, stores persistent preferences under the user profile, and intentionally detaches into a background process to survive parent termination. In a local-agent environment, undisclosed write/persistence behavior materially increases risk of unwanted file modification, persistence, and reduced user control.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This skill advertised as a previewer also writes edited Markdown back to the original file, writes pasted images to disk, stores persistent preferences under the user profile, and intentionally detaches into a background process to survive parent termination. In a local-agent environment, undisclosed write/persistence behavior materially increases risk of unwanted file modification, persistence, and reduced user control.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This skill advertised as a previewer also writes edited Markdown back to the original file, writes pasted images to disk, stores persistent preferences under the user profile, and intentionally detaches into a background process to survive parent termination. In a local-agent environment, undisclosed write/persistence behavior materially increases risk of unwanted file modification, persistence, and reduced user control.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This skill advertised as a previewer also writes edited Markdown back to the original file, writes pasted images to disk, stores persistent preferences under the user profile, and intentionally detaches into a background process to survive parent termination. In a local-agent environment, undisclosed write/persistence behavior materially increases risk of unwanted file modification, persistence, and reduced user control.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This skill advertised as a previewer also writes edited Markdown back to the original file, writes pasted images to disk, stores persistent preferences under the user profile, and intentionally detaches into a background process to survive parent termination. In a local-agent environment, undisclosed write/persistence behavior materially increases risk of unwanted file modification, persistence, and reduced user control.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This skill advertised as a previewer also writes edited Markdown back to the original file, writes pasted images to disk, stores persistent preferences under the user profile, and intentionally detaches into a background process to survive parent termination. In a local-agent environment, undisclosed write/persistence behavior materially increases risk of unwanted file modification, persistence, and reduced user control.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This skill advertised as a previewer also writes edited Markdown back to the original file, writes pasted images to disk, stores persistent preferences under the user profile, and intentionally detaches into a background process to survive parent termination. In a local-agent environment, undisclosed write/persistence behavior materially increases risk of unwanted file modification, persistence, and reduced user control.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This skill advertised as a previewer also writes edited Markdown back to the original file, writes pasted images to disk, stores persistent preferences under the user profile, and intentionally detaches into a background process to survive parent termination. In a local-agent environment, undisclosed write/persistence behavior materially increases risk of unwanted file modification, persistence, and reduced user control.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This skill advertised as a previewer also writes edited Markdown back to the original file, writes pasted images to disk, stores persistent preferences under the user profile, and intentionally detaches into a background process to survive parent termination. In a local-agent environment, undisclosed write/persistence behavior materially increases risk of unwanted file modification, persistence, and reduced user control.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This skill advertised as a previewer also writes edited Markdown back to the original file, writes pasted images to disk, stores persistent preferences under the user profile, and intentionally detaches into a background process to survive parent termination. In a local-agent environment, undisclosed write/persistence behavior materially increases risk of unwanted file modification, persistence, and reduced user control.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This skill advertised as a previewer also writes edited Markdown back to the original file, writes pasted images to disk, stores persistent preferences under the user profile, and intentionally detaches into a background process to survive parent termination. In a local-agent environment, undisclosed write/persistence behavior materially increases risk of unwanted file modification, persistence, and reduced user control.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This skill advertised as a previewer also writes edited Markdown back to the original file, writes pasted images to disk, stores persistent preferences under the user profile, and intentionally detaches into a background process to survive parent termination. In a local-agent environment, undisclosed write/persistence behavior materially increases risk of unwanted file modification, persistence, and reduced user control.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This skill advertised as a previewer also writes edited Markdown back to the original file, writes pasted images to disk, stores persistent preferences under the user profile, and intentionally detaches into a background process to survive parent termination. In a local-agent environment, undisclosed write/persistence behavior materially increases risk of unwanted file modification, persistence, and reduced user control.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

The launch command chains process killing, PID-file deletion, and server startup in one shell line while interpolating <MD_FILE_PATH> into a shell command. In an agent setting, this pattern is dangerous because it couples privileged file/process operations with shell execution, increasing the blast radius of quoting mistakes, path-injection bugs, or accidental termination of processes recorded in the PID file.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

bash

# 单实例清理：只终止上一次本技能启动的预览实例（PID 文件精确定位），不误伤其他进程。整条命令以 python3 常驻结尾。（脱离托管由 python 内部实现跨平台双 fork/detach，不依赖 shell setsid，多行 if 块部分环境识别不到 python3）。
[ -f /tmp/claw-markdown-preview.pid ] && OLD_PID=$(cat /tmp/claw-markdown-preview.pid 2>/dev/null) && [ -n "$OLD_PID" ] && kill -0 "$OLD_PID" 2>/dev/null && kill "$OLD_PID" 2>/dev/null; rm -f /tmp/claw-markdown-preview.pid; python3 scripts/preview_server.py --file "<MD_FILE_PATH>" --no-open --heartbeat-timeout 7200 > /tmp/claw-md-preview.log 2>&1

关键：脱离托管由 preview_server.py 内部自行实现（macOS/Linux 用 os.fork() + os.setsid() 双 fork 成为独立 session leader，Windows 用 subprocess.Popen + DETACHED_PROCESS 启动独立实例），脚本自动判断、不依赖 shell 命令。效果与 shell setsid 一致：服务脱离 WorkBuddy 托管后台任务树，不被"对话闲置回收"机制杀掉（实测托管任务约 20 分钟闲置即回收子进程）。服务因此常驻，离开多久 / 切窗口 / 睡眠都不受影响。跨平台通用，无需 setsid / start /B 等 shell 命令。

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

Using ; to chain cleanup and startup operations makes the command continue even if earlier safety checks fail. In a privileged local-agent context, this can lead to partial execution states, unintended file deletion of PID artifacts, or starting long-lived background services despite failures in validation or shutdown logic.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

bash

# 单实例清理：只终止上一次本技能启动的预览实例（PID 文件精确定位），不误伤其他进程。整条命令以 python3 常驻结尾。（脱离托管由 python 内部实现跨平台双 fork/detach，不依赖 shell setsid，多行 if 块部分环境识别不到 python3）。
[ -f /tmp/claw-markdown-preview.pid ] && OLD_PID=$(cat /tmp/claw-markdown-preview.pid 2>/dev/null) && [ -n "$OLD_PID" ] && kill -0 "$OLD_PID" 2>/dev/null && kill "$OLD_PID" 2>/dev/null; rm -f /tmp/claw-markdown-preview.pid; python3 scripts/preview_server.py --file "<MD_FILE_PATH>" --no-open --heartbeat-timeout 7200 > /tmp/claw-md-preview.log 2>&1

关键：脱离托管由 preview_server.py 内部自行实现（macOS/Linux 用 os.fork() + os.setsid() 双 fork 成为独立 session leader，Windows 用 subprocess.Popen + DETACHED_PROCESS 启动独立实例），脚本自动判断、不依赖 shell 命令。效果与 shell setsid 一致：服务脱离 WorkBuddy 托管后台任务树，不被"对话闲置回收"机制杀掉（实测托管任务约 20 分钟闲置即回收子进程）。服务因此常驻，离开多久 / 切窗口 / 睡眠都不受影响。跨平台通用，无需 setsid / start /B 等 shell 命令。

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · assets/lib/mermaid.min.js (reported line 2)May include surrounding context.

js

olor"?e.body.length===1?qk(e.body[0]):e:e.type==="font"?qk(e.body):e,"getBaseElem"),hGe=new Set(["mathord","textord","atom"]),ih=o(e=>hGe.has(qk(e).type),"isCharacterBox"),dGe=o(e=>{var t=/^[\x00-\x20]*([^\\/#?]*?)(:|&#0*58|&#x0*3a|&colon)/i.exec(e);return t?t[2]!==":"||!/^[a-zA-Z][a-zA-Z0-9+\-.]*$/.test(t[1])?null:t[1].toLowerCase():"_relative"},"protocolFromUrl"),Uk={displayMode:{type:"boolean",description:"Render math in display mode, which puts the math in display style (so \\int and \\sum are large, for example), and centers the math on the page on its own line.",cli:"-d, --display-mode"},output:{type:{enum:["htmlAndMathml","html","mathml"]},description:"Determines the markup language of the output.",cli:"-F, --format <type>"},leqno:{type:"boolean",description:"Render display math in leqno style (left-justified tags)."},fleqn:{type:"boolean",description:"Render display math flush left."},throwOnError:{type:"boolean",default:!0,cli:"-t, --no-throw-on-error",cliDescription:"Render e

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/preview_server.py (reported line 56)May include surrounding context.

python

if os.environ.get('_CMP_DETACHED') == '1':
            return
        args = [sys.executable] + sys.argv
        env = os.environ.copy()
        env['_CMP_DETACHED'] = '1'
        try:
            proc = subprocess.Popen(args, creationflags=0x00000008,

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is described as a Markdown preview tool, but the server also exposes endpoints that can modify and persist file contents. That expands capability from read-only preview to local file editing, which increases the risk of unintended file tampering if the browser UI, a local web page, or another local process interacts with the service.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest frames the skill as local Markdown preview, but the documented behavior includes editing and overwriting the original file plus writing pasted images to disk. That mismatch can cause users or orchestrators to grant the skill read-oriented trust while it performs write operations on user content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document declares lang="zh-CN", and the visible interface text throughout the page is in Chinese, which indicates a fixed language/locale experience. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a Markdown previewer, but the UI exposes editing and persistence features via save controls and POST requests to /api/save. This mismatch expands the skill's effective privileges beyond user expectations, increasing the risk of unintended file modification or abuse if the user only intended read-only preview behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The editor schedules automatic saves in the background after content changes, sending the document to /api/save without an explicit confirmation at the time of write. In a tool described as a previewer, this is especially risky because users may not realize that transient edits or pasted content will be persisted to disk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill accepts pasted images, uploads them to /api/image, and inserts references into the Markdown, which is materially broader than simple preview functionality. This can create files on disk and alter document contents without the capability being obvious from the skill description, raising integrity and transparency concerns.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is described as a local Markdown previewer, but this function goes beyond preview and writes rendered HTML/plaintext directly to the system clipboard. Clipboard writes are security-sensitive because they can overwrite user clipboard contents without an in-file indication of explicit consent, enabling deceptive copy behavior or accidental propagation of rendered content containing unsafe links or markup.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.obfuscated_code

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: assets/lib/markdown-it.min.js:2