ClawHub
Back to skill

Security audit

md-comment

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but its local Markdown review page silently runs third-party CDN scripts that could see private document content.

Use this only for non-sensitive Markdown unless you are comfortable with the viewer contacting jsDelivr and running third-party JavaScript in the review page. Prefer a version that vendors the JavaScript libraries locally or adds pinned SRI and a restrictive CSP.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to run a local HTTP server, open a browser, read an arbitrary Markdown file path, and then read/write a JSON comments file, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: operators may approve the skill without realizing it can access local files and expose content over localhost/network, which is risky in agent environments that rely on declared capabilities.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The viewer loads marked and DOMPurify from third-party CDNs at runtime, which expands trust to external infrastructure for a tool that is supposed to open a local review tab. If the CDN response is tampered with, unavailable, or replaced via dependency compromise, the page could execute attacker-controlled JavaScript in the review context and expose Markdown content or submitted comments.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
This skill's core purpose is local human review of a Markdown document, but it depends on external network resources to render that document. That creates an unnecessary outbound dependency and privacy/integrity risk: opening the viewer may contact third parties and fail or become hostile if those resources are blocked or compromised.

Static analysis

No suspicious patterns detected.