Local Markdown Editor with Live Preview 本地Markdown网页编辑器

• Analyzed: May 11, 2026, 6:31 AM
• Findings: 1
• Version: 1.0.1
• Hash: cff644569bcb82a631026f16e79da83e79f37021cd2e8ec2a68c360274885c1e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill implements a local markdown editor using a Flask server (scripts/app.py) and a web frontend (scripts/index.html). While the behavior is aligned with the stated purpose, the backend lacks any path sanitization or workspace restrictions in the `/api/file`, `/api/open`, and `/api/files` endpoints, allowing for arbitrary file read, write, and directory listing (path traversal) across the entire host system. Although no evidence of intentional malice or data exfiltration was found, the unrestricted file access constitutes a high-risk vulnerability in the context of an AI agent skill.