ClawHub
Back to skill

Security audit

markdown-publish

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it publishes Markdown to a public markdown.page URL, with clear warnings that content is public and should not include secrets or private data.

Install only if you are comfortable with agents publishing selected Markdown to a public, unauthenticated external service. Treat every published page as public and durable; review content for secrets, private conversation details, personal data, or proprietary material before allowing publication.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
---
name: markdown-publish
description: Publishes Markdown to a public URL and returns the link. Use when the user asks to share, publish, host, or get a link for a page — or when you have produced a long page that is better delivered as a link than pasted inline. No authentication required. Pages are public and cannot be edited after publishing, so do not publish secrets or private data.
compatibility: Requires curl and network access to https://markdown.page.
---

# Publish Markdown
Confidence
94% confidence
Finding
curl and network access to https://markdown.page. --- # Publish Markdown Publish Markdown to a public URL. Browsers receive HTML; command-line tools and agents receive plain text. No account or API

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.